4000 Router Series Security Configuration Guide

ManualsBrandsHP ManualsNetwork HardwareHP MSR3024 TAA-compliant AC Router

291

292

293

294

295

296

297

298

299

300

283

• src-mac—Checks whether the sender MAC address in the message body is identical to the source

MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the

packet is discarded.

• dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,

all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is

considered invalid and discarded.

• ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP

requests. All-zero, all-one, or multicast IP addresses are considered invalid and the corresponding

packets are discarded.

To configure ARP packet validity check:

Ste

Command

Remarks

1. Enter system view.

system-view N/A

2. Enter VLAN view.

vlan vlan-id N/A

3. Enable ARP detection.

arp detection enable By default, ARP detection is disabled.

4. Return to system view.

quit N/A

5. Enable ARP packet validity check

and specify the objects to be

checked.

arp detection validate

{ dst-mac | ip | src-mac }

By default, ARP packet validity check

is disabled.

6. Enter Layer 2 Ethernet interface

view.

interface interface-type

interface-number

N/A

7. (Optional.) Configure the interface

as a trusted interface excluded from

ARP detection.

arp detection trust By default, an interface is untrusted.

Configuring ARP restricted forwarding

NOTE:

RP restricted forwardin

does not apply to ARP packets with multiport MAC as their destination MAC

addresses.

ARP restricted forwarding controls the forwarding of ARP packets that are received on untrusted

interfaces and have passed user validity check as follows:

• If the packets are ARP requests, they are forwarded through the trusted interface.

• If the packets are ARP replies, they are forwarded according to their destination MAC address. If no

match is found in the MAC address table, they are forwarded through the trusted interface.

Configured user validity check before you configure ARP restricted forwarding.

To enable ARP restricted forwarding:

Ste