473
When such an interface receives an ARP packet, it checks whether the sender IP address in the
packet is consistent with that of any protected gateway. If yes, it discards the packet. If not, it handles
the packet correctly.
Configuration guidelines
Follow these guidelines when you configure ARP gateway protection:
• You can enable ARP gateway protection for a maximum of eight gateways on an interface.
• Do not configure both the arp filter source and arp filter binding commands on an interface.
• If ARP gateway protection works with ARP attack detection, ARP snooping, and ARP fast-reply,
ARP gateway protection applies first.
Configuration procedure
To configure ARP gateway protection:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter Layer 2 Ethernet interface
and Layer 2 aggregate interface
view.
interface
interface-type
interface-number
N/A
3. Enable ARP gateway protection
for the specified gateway.
arp filter source
ip-address
By default, ARP gateway
protection is disabled.
Configuration example
Network requirements
As shown in Figure 135, Host B launches gateway spoofing attacks to Device B. As a result, traffic
that Device B intends to send to Device A is sent to Host B.
Configure Device B to block such attacks.
Figure 135 Network diagram
To Next Page
Loading...
Need help?
General