4000 Router Series Security Configuration Guide

290

Configuration procedure

To configure ARP filtering:

Ste

Command

Remarks

1. Enter system view.

system-view N/A

2. Enter Layer 2 Ethernet interface

view.

interface interface-type interface-number

N/A

3. Enable ARP filtering and

configure a permitted entry.

arp filter binding ip-address

mac-address

By default, ARP filtering is

disabled.

Configuration example

Network requirements

As shown in Figure 84, the IP and MAC addresses of Host A are 10.1.1.2 and 000f-e349-1233

respectively. The IP and MAC addresses of Host B are 10.1.1.3 and 000f-e349-1234.

Configure ARP filtering on Ethernet 1/1 and Ethernet 1/2 of Switch B to permit ARP packets from the two

hosts only.

Figure 84 Network diagram

Configuration procedure

# Configure ARP filtering on Switch B.

<SwitchB> system-view

[SwitchB] interface ethernet 1/1

[SwitchB-Ethernet1/1] arp filter binding 10.1.1.2 000f-e349-1233

[SwitchB-Ethernet1/1] quit

[SwitchB] interface ethernet 1/2

[SwitchB-Ethernet1/2] arp filter binding 10.1.1.3 000f-e349-1234

After the configuration is complete, Ethernet 1/1 permits ARP packets from Host A, and discards other

ARP packets. Ethernet 1/2 permits ARP packets from Host B and discards other ARP packets.