background image

Layer 3 Forward and ARP Configuration 
Chapter 1 Layer 3 Management Configuration 

http://www.level1.com

                                                                                                                    1-2 

 

1.2 IP Configuration 

1.2.1 Introduction to IPv4, IPv6 

IPv4  is  the  current  version  of  global  universal  Internet  protocol.  The  practice  has 

proved  that  IPv4  is  simple,  flexible,  open,  stable,  strong  and  easy  to  implement  while 

collaborating well with various protocols of upper and lower layers. Although IPv4 almost 

has not been changed since it was established in 1980’s, it has kept growing to the current 

global  scale  with  the  promotion  of  Internet.  However,  as  Internet  infrastructure  and 

Internet application services continue boosting, IPv4 has shown its deficiency when facing 

the present scale and complexity of Internet. 

IPv6  refers  to  the  sixth  version  of  Internet  protocol  which  is  the  next  generation 

Internet protocol designed by IETF to replace the current Internet protocol version 4 (IPv4). 

IPv6 was specially developed to make up the shortages of IPv4 addresses so that Internet 

can develop further. 

The most important problem IPv6 has solved is to add the amount of IP addresses. 

IPv4  addresses  have  nearly  run  out,  whereas  the  amount  of  Internet  users  has  been 

increasing  in  geometric  series.  With  the  greatly  and  continuously  boosting  of  Internet 

services and application devices (Home and Small Office Network, IP phone and Wireless 

Service Information Terminal which make use of Internet,) which require IP addresses, the 

supply of IP addresses turns out to be more and more tense. People have been working 

on  the  problem  of  shortage  of  IPv4  addresses  for  a  long  time  by  introducing  various 

technologies  to  prolong  the  lifespan  of  existing  IPv4  infrastructure,  including  Network 

Address Translation(NAT for short), and Classless Inter-Domain Routing(CIDR for short), 

etc.       

Although  the  combination  of  CIDR,  NAT  and  private  addressing  has  temporarily 

mitigated the problem of IPv4 address space shortage, NAT technology has disrupted the 

end-to-end model which is the original intention of IP design by making it necessary for 

router  devices  that  serve  as  network  intermediate  nodes  to  maintain  every  connection 

status  which  increases  network  delay  greatly  and  decreases  network  performance. 

Moreover,  the  translation  of  network  data  packet  addresses  baffles  the  end-to-end 

network security check, IPSec authentication header is such an example.     

Therefore, in order to solve all kinds of problems existing in IPv4 comprehensively, 

the next generation Internet Protocol IPv6 designed by IETF has become the only feasible 

no

 description 

The no command will cancel the description information 

of VLAN interface. 

Summary of Contents for GTL-2890

Page 1: ...Layer 3 Forward and ARP Configuration Content http www level1 com 1 GTL 2890 GTL 5260 Layer 3 Forward and ARP Configuration...

Page 2: ...2 Introduction to Default Route 1 6 1 3 3 Static Route Configuration Task List 1 7 1 3 4 Static Route Configuration Examples 1 7 1 4 ARP 1 8 1 4 1 Introduction to ARP 1 8 1 4 2 ARP Configuration Task...

Page 3: ...P GUARD CONFIGURATION TASK LIST 4 2 CHAPTER 5 GRATUITOUS ARP CONFIGURATION 5 1 5 1 INTRODUCTION TO GRATUITOUS ARP 5 1 5 2 GRATUITOUS ARP CONFIGURATION TASK LIST 5 1 5 3 GRATUITOUS ARP CONFIGURATION EX...

Page 4: ...or contain no layer 2 ports At least one of the Layer 2 ports contained in Layer 3 interface should be in UP state for Layer 3 interface in UP state otherwise Layer 3 interface will be in DOWN state T...

Page 5: ...With the greatly and continuously boosting of Internet services and application devices Home and Small Office Network IP phone and Wireless Service Information Terminal which make use of Internet whi...

Page 6: ...Automatic address configuration function also makes the readdressing of existing network easier and more convenient and it is more convenient for network operators to manage the transformation from o...

Page 7: ...only saves network bandwidth but enhances network efficiency as well 1 2 2 IP Configuration Layer 3 interface can be configured as IPv4 interface IPv6 interface 1 2 2 1 IPv4 Address Configuration IPv4...

Page 8: ...ace Configuration Mode ipv6 nd dad attempts value no ipv6 nd dad attempts Set the neighbor query message number sent in sequence when the interface makes duplicate address detection The no command res...

Page 9: ...ic route is mainly used in the following two conditions 1 in stable networks to reduce load of route selection and routing data streams For example static route can be used in route to STUB network 2...

Page 10: ...ateway interface distance command deletes a static route entry 1 3 4 Static Route Configuration Examples The figure shown below is a simple network consisting of three layer3 switches the network mask...

Page 11: ...established between PC A and PC C and PC B and PC C 1 4 ARP 1 4 1 Introduction to ARP ARP Address Resolution Protocol is mainly used to resolve IP address to Ethernet MAC address Switch supports stat...

Page 12: ...3 Management Configuration http www level1 com 1 9 If ARP has not been learned then enabled ARP debugging information and view the sending receiving condition of ARP packets Defective cable is a comm...

Page 13: ...o prevent ARP scanning if there is any host or port with ARP scanning features is found in the segment the switch will cut off the attack source to ensure the security of the network There are two met...

Page 14: ...lly 2 Configure the threshold of the port based and IP based ARP Scanning Prevention Command Explanation Global configuration mode anti arpscan port based threshold threshold value no anti arpscan por...

Page 15: ...arpscan recovery time Set automatic recovery time 6 Display relative information of debug information and ARP scanning Command Explanation Global configuration mode anti arpscan log enable no anti arp...

Page 16: ...peration of the system SWITCH A configuration task sequence SwitchA config anti arpscan enable SwitchA config anti arpscan recovery time 3600 SwitchA config anti arpscan trust ip 192 168 1 100 255 255...

Page 17: ...ntion Function Configuration http www level1 com 2 5 2 4 ARP Scanning Prevention Troubleshooting Help ARP scanning prevention is disabled by default After enabling ARP scanning prevention users can en...

Page 18: ...it will also insert an entry to its ARP cache table so it creates a possibility of ARP spoofing If the hacker wants to snoop the communication between two host computers in the same network even if ar...

Page 19: ...etworks is to disable switch automatic update function the cheater can t modify corrected MAC address in order to avoid wrong packets transfer and can t obtain other information At one time it doesn t...

Page 20: ...to A firstly A sends ARP reply packet to switch format is 192 168 2 3 00 00 00 00 00 01 mapping its MAC address to C s IP so the switch changes IP address when it updates ARP list then data packet of...

Page 21: ...0 00 00 02 interface ethernet 1 0 2 Switch config if vlan1 arp 192 168 2 3 00 00 00 00 00 03 interface ethernet 1 0 3 Switch Config If Vlan3 exit Switch Config ip arp security learnprotect Switch Conf...

Page 22: ...PC2 is mapped to an illegal MAC address which will prevent PC2 from receiving the messages to it Particularly if the attacker pretends to be the gateway and do ARP cheating the whole network will be...

Page 23: ...ttp www uttglobal com 4 2 scheme Please refer to relative documents for details 4 2 ARP GUARD Configuration Task List 1 Configure the protected IP address Command Explanation Port configuration mode a...

Page 24: ...C address of the gateway If the switch advertises gratuitous ARP requests the host will not have to send these requests This will reduce the frequency the hosts sending ARP requests for the gateway s...

Page 25: ...re above interface VLAN10 whose IP address is 192 168 15 254 and network address mask is 255 255 255 0 in the switch system Five PCs PC1 PC2 PC3 PC4 PC5 are connected to the interface Gratuitous ARP c...

Page 26: ...ARP send If gratuitous ARP is enabled in global configuration mode it can be disabled only in global configuration mode If gratuitous ARP is configured in interface configuration mode the configuratio...

Page 27: ...a packet is received from the trusted port the switch will not inspect it and forward it directly If the ARP data packet is received from the untrusted port the switch will only forward the lawful dat...

Page 28: ...e DHCP server is 00 24 8c 01 05 90 the IP address of 192 168 10 2 needs to be distributed statically the DHCP server is connected to e 1 0 1 The MAC of the specific server Other Server is 00 24 8c 01...

Page 29: ...t rate 50 interface Vlan10 ip address 192 168 10 1 255 255 255 0 Explanation In this case there are two method of static and dynamic using of DAI The ARP packets from the untrusted port will all be tr...

Reviews: