276
[SwitchB] interface gigabitethernet 1/0/1
[SwitchB-Gigabitethernet 1/0/1] dot1x
[SwitchB-Gigabitethernet 1/0/1] quit
[SwitchB] interface gigabitethernet 1/0/2
[SwitchB-Gigabitethernet 1/0/2] dot1x
[SwitchB-Gigabitethernet 1/0/2] quit
# Add local access user test.
[SwitchB] local-user test
[SwitchB-luser-test] service-type lan-access
[SwitchB-luser-test] password simple test
[SwitchB-luser-test] quit
# Enable ARP detection for VLAN 10.
[SwitchB] vlan 10
[SwitchB-vlan10] arp detection enable
# Configure the upstream port as a trusted port and the downstream ports as untrusted ports (a port is an
untrusted port by default).
[SwitchB-vlan10] interface gigabitethernet 1/0/3
[SwitchB-gigabitethernet1/0/3] arp detection trust
[SwitchB-gigabitethernet1/0/3] quit
After the preceding configurations are complete, when ARP packets arrive at interfaces GigabitEthernet
1/0/1 and GigabitEthernet 1/0/2, they are checked against 802.1X security entries.
ARP restricted forwarding configuration example
Network requirements
As shown in Figure 86, Switch A acts as a DHCP server. Host A acts as a DHCP client. Host B’s IP
address is 10.1.1.6, and its MAC address is 0001-0203-0607. Port isolation configured on Switch B
isolates the two hosts at Layer 2, which can communicate with the gateway Switch A. GigabitEthernet
1/0/1, GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 belong to VLAN 10. Switch B is enabled
with DHCP snooping, and has ARP detection enabled in VLAN 10.
Configure Switch B to still perform port isolation on ARP broadcast requests.
To Next Page
Loading...
