HP 5500 HI Series User Manual

378
• At least the configured rules, static IP source guard binding entries, DHCP snooping entries, or
802.1X security entries must be available for user validity check. Otherwise, ARP packets received
from ARP untrusted ports will be discarded, except the ARP packets with an OUI MAC address as
the sender MAC address when voice VLAN is enabled.
• You must specify a VLAN for an IP source guard binding entry. Otherwise, no ARP packets can
match the IP source guard binding entry.
Configuration procedure
To configure user validity check:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Set rules for user validity
check.
arp detection id-number { permit |
deny } ip { any | ip-address
[ ip-address-mask ] } mac { any |
mac-address [ mac-address-mask ] }
[ vlan vlan-id ]
Optional.
By default, no rule is configured.
3. Enter VLAN view.
vlan vlan-id N/A
4. Enable ARP detection for the
VLAN.
arp detection enable
ARP detection based on static IP
source guard binding
entries/DHCP snooping
entries/802.1X security
entries/OUI MAC addresses is
disabled by default.
5. Return to system view.
quit N/A
6. Enter Layer 2 Ethernet
interface/Layer 2 aggregate
interface view.
interface interface-type
interface-number
N/A
7. Configure the port as a
trusted port on which ARP
detection does not apply.
arp detection trust
Optional.
The port is an untrusted port by
default.
Configuring ARP packet validity check
Perform this task to enable validity check for ARP packets received on untrusted ports and specify the
following objects to be checked.
• src-mac—Checks whether the sender MAC address in the message body is identical to the source
MAC address in the Ethernet header. If they are identical, the packet is forwarded. Otherwise, the
packet is discarded.
• dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
• ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP
requests. All-zero, all-one, or multicast IP addresses are considered invalid and the corresponding
packets are discarded.
To configure ARP packet validity check:

HP 5500 HI Series Specifications

General

Brand	HP
Model	5500 HI Series
Category	Switch
Language	English