R211x-HP Flexfabric 11900 Security Configuration Guide

220
• Monitor—Only generates log messages.
• Filter—Generates log messages and filters out subsequent ARP packets from that MAC address.
You can exclude the MAC addresses of some gateways and servers from this detection. This feature does
not inspect ARP packets from those devices even if they are attackers.
Configuration procedure
To configure source MAC-based ARP attack detection:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enable source MAC-based
ARP attack detection and
specify the handling method.
arp source-mac { filter | monitor } By default, this feature is disabled.
3. Configure the threshold.
arp source-mac threshold
threshold-value
The default threshold is 30
packets.
4. Configure the aging timer for
ARP attack entries.
arp source-mac aging-time time
By default, the lifetime is 300
seconds.
5. (Optional.) Exclude specified
MAC addresses from this
detection.
arp source-mac exclude-mac
mac-address&<1-10>
By default, no MAC address is
excluded.
NOTE:
W
hen an ARP attack entry expires, ARP packets sourced from the MAC address in the entry can be
processed correctly.
Displaying and maintaining source MAC-based ARP attack
detection
Execute display commands in any view.
Task Command
Display ARP attack entries detected by source
MAC-based ARP attack detection (in standalone
mode).
display arp source-mac { slot slot-number | interface
interface-type interface-number }
Display ARP attack entries detected by source
MAC-based ARP attack detection (in IRF mode).
display arp source-mac { chassis chassis-number slot
slot-number | interface interface-type interface-number }