424
Configuration procedure
1. Add all interfaces on Switch B to VLAN 10, and specify the IP address of VLAN-interface 10 on
Switch A. (Details not shown.)
2. Configure the DHCP server on Switch A, and configure DHCP address pool 0.
<SwitchA> system-view
[SwitchA] dhcp enable
[SwitchA] dhcp server ip-pool 0
[SwitchA-dhcp-pool-0] network 10.1.1.0 mask 255.255.255.0
3. Configure Host A (DHCP client) and Host B. (Details not shown.)
4. Configure Switch B:
# Enable DHCP snooping.
<SwitchB> system-view
[SwitchB] dhcp snooping enable
[SwitchB] interface gigabitethernet 1/0/3
[SwitchB-GigabitEthernet1/0/3] dhcp snooping trust
[SwitchB-GigabitEthernet1/0/3] quit
# Enable recording of client information in DHCP snooping entries on GigabitEthernet 1/0/1.
[SwitchB] interface gigabitethernet 1/0/1
[SwitchB-GigabitEthernet1/0/1] dhcp snooping binding record
[SwitchB-GigabitEthernet1/0/1] quit
# Enable ARP attack detection for VLAN 10.
[SwitchB] vlan 10
[SwitchB-vlan10] arp detection enable
# Configure the upstream interface as a trusted interface. By default, an interface is an
untrusted interface.
[SwitchB-vlan10] interface gigabitethernet 1/0/3
[SwitchB-GigabitEthernet1/0/3] arp detection trust
[SwitchB-GigabitEthernet1/0/3] quit
# Configure a static IP source guard binding on interface GigabitEthernet 1/0/2 for user validity
check.
[SwitchB] interface gigabitethernet 1/0/2
[SwitchB-GigabitEthernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address
0001-0203-0607 vlan 10
[SwitchB-GigabitEthernet1/0/2] quit
# Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP
packets.
[SwitchB] arp detection validate dst-mac ip src-mac
After the configurations are completed, Switch B first checks the validity of ARP packets
received on GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2. If the ARP packets are confirmed
as valid, the switch performs user validity check by using the static IP source guard bindings
and finally DHCP snooping entries.
ARP restricted forwarding configuration example
Network requirements
As shown in Figure 127, configure ARP restricted forwarding on Switch B where ARP attack
detection is configured. Port isolation configured on Switch B can take effect for broadcast ARP
requests.
To Next Page
Loading...
Need help?
General