R0106-HP MSR Router Series Security Configuration Guide(V7)

414

[SwitchB-GigabitEthernet2/1/3] dhcp snooping trust

[SwitchB-GigabitEthernet2/1/3] quit

# Enable recording of client information in DHCP snooping entries on GigabitEthernet 2/1/1.

[SwitchB] interface gigabitethernet 2/1/1

[SwitchB-GigabitEthernet2/1/1] dhcp snooping binding record

[SwitchB-GigabitEthernet2/1/1] quit

# Enable ARP detection for VLAN 10.

[SwitchB] vlan 10

[SwitchB-vlan10] arp detection enable

# Configure the upstream interface as a trusted interface. By default, an interface is an untrusted

interface.

[SwitchB-vlan10] interface gigabitethernet 2/1/3

[SwitchB-GigabitEthernet2/1/3] arp detection trust

[SwitchB-GigabitEthernet2/1/3] quit

# Configure a static IP source guard binding entry on interface GigabitEthernet 2/1/2 for user

validity check.

[SwitchB] interface gigabitethernet 2/1/2

[SwitchB-GigabitEthernet2/1/2] ip source binding ip-address 10.1.1.6 mac-address

0001-0203-0607 vlan 10

[SwitchB-GigabitEthernet2/1/2] quit

# Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP

packets.

[SwitchB] arp detection validate dst-mac ip src-mac

After the configurations are completed, ARP packets received on interfaces GigabitEthernet

2/1/1 and GigabitEthernet 2/1/2 have their MAC and IP addresses checked first, and then are

checked against the static IP source guard binding entries and finally DHCP snooping entries.

ARP restricted forwarding configuration example

Network requirements

As shown in Figure 125, configure ARP restricted forwarding on Switch B where ARP detection is

configured so that port isolation configured on Switch B can take effect for broadcast ARP requests.