viii

Configuring unresolvable IP attack protection ·········································································································· 326

Configuring ARP source suppression ················································································································ 327

Configuring ARP blackhole routing ··················································································································· 327

Displaying and maintaining unresolvable IP attack protection ······································································ 328

Configuration example ······································································································································· 328

Configuring ARP packet rate limit ······························································································································ 329

Configuration guidelines ···································································································································· 329

Configuration procedure ···································································································································· 329

Configuring source MAC-based ARP attack detection ···························································································· 330

Configuration procedure ···································································································································· 330

Displaying and maintaining source MAC-based ARP attack detection ························································· 331

Configuration example ······································································································································· 331

Configuring ARP packet source MAC consistency check ························································································ 332

Configuring ARP active acknowledgement ··············································································································· 332

Configuring authorized ARP ······································································································································· 333

Configuration procedure ···································································································································· 333

Configuration example (on a DHCP server) ····································································································· 333

Configuration example (on a DHCP relay agent) ···························································································· 334

Configuring ARP detection ·········································································································································· 336

Configuring user validity check ························································································································· 336

Configuring ARP packet validity check ············································································································· 337

Configuring ARP restricted forwarding ············································································································· 338

Displaying and maintaining ARP detection ······································································································ 338

User validity check and ARP packet validity check configuration example ·················································· 339

Configuring ARP scanning and fixed ARP ················································································································ 340

Configuration restrictions and guidelines ········································································································· 340

Configuration procedure ···································································································································· 341

Configuring ARP gateway protection ························································································································ 341

Configuration guidelines ···································································································································· 341

Configuration procedure ···································································································································· 341

Configuration example ······································································································································· 342

Configuring ARP filtering ············································································································································· 342

Configuration guidelines ···································································································································· 343

Configuration procedure ···································································································································· 343

Configuration example ······································································································································· 343

Configuring MFF ····················································································································································· 345

Overview ······································································································································································· 345

Basic concepts ····················································································································································· 346

MFF operation modes ········································································································································· 347

MFF working mechanism ···································································································································· 347

Protocols and standards ····································································································································· 347

Configuring MFF ·························································································································································· 347

Enabling MFF ······················································································································································· 347

Configuring a network port ································································································································ 348

Enabling periodic gateway probe ···················································································································· 348

Specifying the IP addresses of servers ·············································································································· 348

Displaying and maintaining MFF ······························································································································· 349

MFF configuration examples ······································································································································· 349

Manual-mode MFF configuration example in a tree network ········································································· 349

Manual-mode MFF configuration example in a ring network ········································································ 351

Configuring uRPF ····················································································································································· 353

Overview ······································································································································································· 353

uRPF check modes ··············································································································································· 353