Configuring arp packet validity check – H3C Technologies H3C WX3000E Series Wireless Switches User Manual

Page 349

Advertising
background image

335

Step Command

Remarks

6.

Configure the port as a trusted port
on which ARP detection does not

apply.

arp detection trust

Optional.
A port is an untrusted port by

default.

NOTE:

At least the static IP source guard binding entries, DHCP snooping entries, or 802.1X security entries
used for user validity check must be available. Otherwise, ARP packets received from ARP untrusted

ports will be discarded, except for the ARP packets whose sender MAC address is an OUI MAC address

when voice VLAN is enabled.

You must specify a VLAN for an IP source guard binding entry. Otherwise, no ARP packets can match
the IP source guard binding entry.

Configuring ARP packet validity check

Perform this task to enable validity check for ARP packets received on untrusted ports and specify the

following objects to be checked:

src-mac: Checks whether the sender MAC address in the message body is identical to the source
MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the
packet is discarded.

dst-mac: Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is

considered invalid and discarded.

ip: Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP
requests. All-zero, all-one, or multicast IP addresses are considered invalid and the corresponding

packets are discarded.

To configure ARP packet validity check:

Step Command

Remarks

1.

Enter system view.

system-view

N/A

2.

Enter VLAN view.

vlan vlan-id N/A

3.

Enable ARP detection.

arp detection enable

Disabled by default.

4.

Return to system view.

quit

N/A

5.

Enable ARP packet validity check

and specify the objects to be
checked.

arp detection validate
{ dst-mac | ip | src-mac } *

Not specified by default.

6.

Enter Ethernet interface view.

interface interface-type
interface-number

N/A

7.

Configure the port as a trusted

port on which ARP detection does

not apply.

arp detection trust

Optional.
A port is an untrusted port by

default.

Advertising