R3303-HP 6600/HSR6600 Routers Security Configuration Guide

524
# Configure a static IP source guard binding entry on interface GigabitEthernet 3/0/2 for user
validity check.
[RouterB] interface gigabitethernet 3/0/2
[RouterB-GigabitEthernet3/0/2] port link-mode bridge
[RouterB-GigabitEthernet3/0/2] ip source binding ip-address 10.1.1.6 mac-address
0001-0203-0607 vlan 10
[RouterB-GigabitEthernet3/0/2] ip verify source ip-address mac-address
[RouterB-GigabitEthernet3/0/2] quit
# Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP
packets.
[RouterB] arp detection validate dst-mac ip src-mac
After the configurations are completed, ARP packets received on interfaces GigabitEthernet
3/0/1 and GigabitEthernet 3/0/2, have their MAC and IP addresses checked first, and then are
checked against the static IP source guard binding entries and finally DHCP snooping entries.
ARP restricted forwarding configuration example
Network requirements
As shown in Figure 253,
• Configure DHCP snooping and enable ARP detection in VLAN 10 on Router B.
• Configure the DHCP server on Router A.
• Configure port isolation on Router B to isolate the two hosts at Layer 2.
• Enable ARP restricted forwarding in VLAN 10.
Figure 253 Network diagram
Configuration procedure
1. Configure VLAN 10, add ports to VLAN 10, and configure the IP address of the VLAN-interface.
(Details not shown.)
2. Configure the DHCP server on Router A:
<RouterA> system-view