Configuring arp packet validity check – H3C Technologies H3C WX3000E Series Wireless Switches User Manual
Page 349

335
Step Command
Remarks
6.
Configure the port as a trusted port
on which ARP detection does not
apply.
arp detection trust
Optional.
A port is an untrusted port by
default.
NOTE:
•
At least the static IP source guard binding entries, DHCP snooping entries, or 802.1X security entries
used for user validity check must be available. Otherwise, ARP packets received from ARP untrusted
ports will be discarded, except for the ARP packets whose sender MAC address is an OUI MAC address
when voice VLAN is enabled.
•
You must specify a VLAN for an IP source guard binding entry. Otherwise, no ARP packets can match
the IP source guard binding entry.
Configuring ARP packet validity check
Perform this task to enable validity check for ARP packets received on untrusted ports and specify the
following objects to be checked:
•
src-mac: Checks whether the sender MAC address in the message body is identical to the source
MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the
packet is discarded.
•
dst-mac: Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
•
ip: Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP
requests. All-zero, all-one, or multicast IP addresses are considered invalid and the corresponding
packets are discarded.
To configure ARP packet validity check:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter VLAN view.
vlan vlan-id N/A
3.
Enable ARP detection.
arp detection enable
Disabled by default.
4.
Return to system view.
quit
N/A
5.
Enable ARP packet validity check
and specify the objects to be
checked.
arp detection validate
{ dst-mac | ip | src-mac } *
Not specified by default.
6.
Enter Ethernet interface view.
interface interface-type
interface-number
N/A
7.
Configure the port as a trusted
port on which ARP detection does
not apply.
arp detection trust
Optional.
A port is an untrusted port by
default.
- H3C WX5500E Series Access Controllers H3C WX3500E Series Access Controllers H3C WX2500E Series Access Controllers H3C WX6000 Series Access Controllers H3C WX5000 Series Access Controllers H3C LSWM1WCM10 Access Controller Module H3C LSUM3WCMD0 Access Controller Module H3C LSUM1WCME0 Access Controller Module H3C LSWM1WCM20 Access Controller Module H3C LSQM1WCMB0 Access Controller Module H3C LSRM1WCM2A1 Access Controller Module H3C LSBM1WCM2A0 Access Controller Module H3C WA3600 Series Access Points H3C WA2600 Series WLAN Access Points H3C S10500 Series Switches H3C S5800 Series Switches H3C S5820X Series Switches H3C S12500 Series Switches H3C S9500E Series Switches H3C MSR 5600 H3C MSR 50 H3C MSR 3600 H3C MSR 30 H3C MSR 2600 H3C MSR 20-2X[40] H3C MSR 20-1X H3C MSR 930 H3C MSR 900 H3C SR8800 H3C SR6600-X H3C SR6600 H3C SecPath F5020 H3C SecPath F5040 H3C VMSG VFW1000