R21xx-HP FlexFabric 11900 Security Configuration Guide

128
Figure 45 Network diagram
Configuration considerations
An attacker might forge a large number of ARP packets by using the MAC address of a valid host as the
source MAC address. To prevent such attacks, configure the gateway in the following steps.
• Enable source MAC address based ARP attack detection and specify the handling method as filter.
• Set the threshold.
• Set the lifetime for ARP attack entries.
• Exclude the MAC address of the server from this detection.
Configuration procedure
# Enable source MAC address-based ARP attack detection and specify the handling method as filter.
<Device> system-view
[Device] arp source-mac filter
# Set the threshold to 50.
[Device] arp source-mac threshold 50
# Set the lifetime for ARP attack entries to 60 seconds.
[Device] arp source-mac aging-time 60
# Exclude MAC address 0012-3f86-e94c from this detection.
[Device] arp source-mac exclude-mac 0012-3f86-e94c
IP network
Gateway
Device
Host A Host B Host C Host D
ARP attack protection
Server
0012-3f86-e94c