Configuring Arp Packet Validity Check - HP 3600 v2 Series Configuration Manual

Configuration guideliens
Follow these guidelines when you configure user validity check:
• Static IP source guard binding entries are created by using the ip source binding command. For
more information, see
Dynamic DHCP snooping entries are automatically generated by DHCP snooping. For more
•
information, see Layer 3—IP Services Configuration Guide.
802.1X security entries are generated by 802.1X. After a client passes 802.1X authentication and
•
uploads its IP address to an ARP detection enabled device, the device automatically generates an
802.1X security entry. Therefore, the 802.1X client must be able to upload its IP address to the device.
For more information, see
At least the configured rules, static IP source guard binding entries, DHCP snooping entries, or
•
802.1X security entries must be available for user validity check. Otherwise, ARP packets received
from ARP untrusted ports will be discarded, except the ARP packets with an OUI MAC address as
the sender MAC address when voice VLAN is enabled.
You must specify a VLAN for an IP source guard binding entry. Otherwise, no ARP packets can
•
match the IP source guard binding entry.
Configuration procedure
To configure user validity check:
Step
1. Enter system view.
2. Set rules for user validity
check.
Enter VLAN view.
3.
4. Enable ARP detection for the
VLAN.
5. Return to system view.
6. Enter Layer 2 Ethernet
interface/Layer 2 aggregate
interface view.
7. Configure the port as a
trusted port on which ARP
detection does not apply.

Configuring ARP packet validity check

Perform this task to enable validity check for ARP packets received on untrusted ports and specify the
following objects to be checked.
"Configuring IP source
"Configuring 802.1X."
Command
system-view
arp detection id-number { permit |
deny } ip { any | ip-address
[ ip-address-mask ] } mac { any |
mac-address [ mac-address-mask ] }
[ vlan vlan-id ]
vlan vlan-id
arp detection enable
quit
interface interface-type
interface-number
arp detection trust
381
guard."
Remarks
N/A
Optional.
By default, no rule is configured.
N/A
ARP detection based on static IP
source guard binding
entries/DHCP snooping
entries/802.1X security
entries/OUI MAC addresses is
disabled by default.
N/A
N/A
Optional.
The port is an untrusted port by
default.