R211x-HP Flexfabric 11900 Security Configuration Guide

229
[SwitchB] interface ten-gigabitethernet 1/0/3
[SwitchB-Ten-GigabitEthernet1/0/3] dhcp snooping trust
[SwitchB-Ten-GigabitEthernet1/0/3] quit
[SwitchB] interface ten-gigabitethernet 1/0/1
[SwitchB-Ten-GigabitEthernet1/0/1] dhcp snooping binding record
[SwitchB-Ten-GigabitEthernet1/0/1] quit
# Enable ARP detection for VLAN 10.
[SwitchB] vlan 10
[SwitchB-vlan10] arp detection enable
# Configure the upstream interface as a trusted interface (an interface is an untrusted interface by
default).
[SwitchB-vlan10] interface ten-gigabitethernet 1/0/3
[SwitchB-Ten-GigabitEthernet1/0/3] arp detection trust
[SwitchB-Ten-GigabitEthernet1/0/3] quit
# Configure a static IP source guard binding entry on interface Ten-GigabitEthernet 1/0/2 for user
validity check.
[SwitchB] interface ten-gigabitethernet 1/0/2
[SwitchB-Ten-GigabitEthernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address
0001-0203-0607 vlan 10
[SwitchB-Ten-GigabitEthernet1/0/2] quit
# Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP
packets.
[SwitchB] arp detection validate dst-mac ip src-mac
After the configurations are completed, ARP packets received on interfaces Ten-GigabitEthernet
1/0/1 and Ten-GigabitEthernet 1/0/2 have their MAC and IP addresses checked first, and then
are checked against the static IP source guard binding entries and finally DHCP snooping entries.
Configuring ARP automatic scanning and fixed ARP
ARP automatic scanning is usually used together with the fixed ARP feature in small-scale networks such
as a cybercafe.
With ARP automatic scanning enabled on an interface, the device automatically performs the following
functions:
• Scans neighbors on the interface.
• Sends ARP requests to the neighbors.
• Obtains their MAC addresses.
• Creates dynamic ARP entries.
Fixed ARP allows the device to convert existing dynamic ARP entries (including those generated through
ARP automatic scanning) to static ARP entries. The fixed ARP feature prevents ARP entries from being
modified by attackers. Static ARP entries can also be manually configured by the arp static command.
Configuration guidelines
When you configure ARP automatic scanning and fixed ARP, follow these guidelines:
• IP addresses existing in ARP entries are not scanned.