Configuring Arp Detection - HP FlexNetwork 10500 Series Security Configuration Manual

[DeviceA-dhcp-pool-1] gateway-list 10.10.1.1
[DeviceA-dhcp-pool-1] quit
[DeviceA] ip route-static 10.10.1.0 24 10.1.1.2
2. Configure Device B:
# Enable DHCP.
<DeviceB> system-view
[DeviceB] dhcp enable
# Specify the IP addresses of GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2.
[DeviceB] interface gigabitethernet 1/0/1
[DeviceB-GigabitEthernet1/0/1] ip address 10.1.1.2 24
[DeviceB-GigabitEthernet1/0/1] quit
[DeviceB] interface gigabitethernet 1/0/2
[DeviceB-GigabitEthernet1/0/2] ip address 10.10.1.1 24
# Enable DHCP relay agent on GigabitEthernet 1/0/2.
[DeviceB-GigabitEthernet1/0/2] dhcp select relay
# Add the DHCP server 10.1.1.1 to DHCP server group 1.
[DeviceB-GigabitEthernet1/0/2] dhcp relay server-address 10.1.1.1
# Enable authorized ARP.
[DeviceB-GigabitEthernet1/0/2] port link-mode route
[DeviceB-GigabitEthernet1/0/2] arp authorized enable
[DeviceB-GigabitEthernet1/0/2] quit
# Enable recording of relay entries on the relay agent.
[DeviceB] dhcp relay client-information record
3. Configure Device C:
<DeviceC> system-view
[DeviceC] ip route-static 10.1.1.0 24 10.10.1.1
[DeviceC] interface gigabitethernet 1/0/2
[DeviceC-GigabitEthernet1/0/2] ip address dhcp-alloc
[DeviceC-GigabitEthernet1/0/2] quit
Verifying the configuration
# Display authorized ARP information on Device B.
[DeviceB] display arp all
Type: S-Static
IP Address
10.10.1.2
The output shows that Device A assigned the IP address 10.10.1.2 to Device C.
Device C must use the IP address and MAC address in the authorized ARP entry to communicate
with Device B. Otherwise, the communication fails. Thus the user validity is ensured.

Configuring ARP detection

ARP detection enables access devices to block ARP packets from unauthorized clients to prevent
user spoofing and gateway spoofing attacks. ARP detection does not check ARP packets received
from ARP trusted ports.
ARP detection provides the following features:
•
User validity check.
D-Dynamic O-Openflow
MAC Address VLAN
0012-3f86-e94c N/A
M-Multiport
Interface
GE1/0/2
437
I-Invalid
Aging Type
20 D