R3303-HP 6600/HSR6600 Routers Security Configuration Guide

522
Configuration procedure
1. Add all ports on Router B into VLAN 10, and configure the IP address of VLAN-interface 10 on
Router A. (Details not shown.)
2. Configure the DHCP server on Router A.
<RouterA> system-view
[RouterA] dhcp enable
[RouterA] dhcp server ip-pool 0
[RouterA-dhcp-pool-0] network 10.1.1.0 mask 255.255.255.0
3. Configure Host A and Host B as 802.1X clients and configure them to upload IP addresses for ARP
detection. (Details not shown.)
4. Configure Router B:
# Enable the 802.1X function.
<RouterB> system-view
[RouterB] dot1x
[RouterB] interface gigabitethernet 3/0/1
[RouterB-GigabitEthernet3/0/1] port link-mode bridge
[RouterB-GigabitEthernet3/0/1] dot1x
[RouterB-GigabitEthernet3/0/1] quit
[RouterB] interface gigabitethernet 3/0/2
[RouterB-GigabitEthernet3/0/2] port link-mode bridge
[RouterB-GigabitEthernet3/0/2] dot1x
[RouterB-GigabitEthernet3/0/2] quit
# Add a local user test.
[RouterB] local-user test
[RouterB-luser-test] service-type lan-access
[RouterB-luser-test] password simple test
[RouterB-luser-test] quit
# Enable ARP detection for VLAN 10 to check user validity based on 802.1X entries.
[RouterB] vlan 10
[RouterB-vlan10] arp detection enable
# Configure the upstream port as an ARP-trusted port (a port is an untrusted port by default).
[RouterB-vlan10] interface gigabitethernet 3/0/3
[RouterB-GigabitEthernet3/0/3] port link-mode bridge
[RouterB-GigabitEthernet3/0/3] arp detection trust
[RouterB-GigabitEthernet3/0/3] quit
After the configurations are completed, ARP packets received on interfaces GigabitEthernet
3/0/1 and GigabitEthernet 3/0/2 are checked against 802.1X entries.
User validity check and ARP packet validity check
configuration example
Network requirements
As shown in Figure 252,
• Configure the DHCP server on Router A.