425
Figure 127 Network diagram
Configuration procedure
1. Configure VLAN 10, add interfaces to VLAN 10, and specify the IP address of the VLAN
interface. (Details not shown.)
2. Configure the DHCP server on Switch A, and configure DHCP address pool 0.
<SwitchA> system-view
[SwitchA] dhcp enable
[SwitchA] dhcp server ip-pool 0
[SwitchA-dhcp-pool-0] network 10.1.1.0 mask 255.255.255.0
3. Configure Host A (DHCP client) and Host B. (Details not shown.)
4. Configure Switch B:
# Enable DHCP snooping, and configure GigabitEthernet 1/0/3 as a DHCP-trusted port.
<SwitchB> system-view
[SwitchB] dhcp snooping enable
[SwitchB] interface gigabitethernet 1/0/3
[SwitchB-GigabitEthernet1/0/3] dhcp snooping trust
[SwitchB-GigabitEthernet1/0/3] quit
# Enable ARP attack detection for user validity check.
[SwitchB] vlan 10
[SwitchB-vlan10] arp detection enable
# Configure GigabitEthernet 1/0/3 as an ARP-trusted port.
[SwitchB-vlan10] interface gigabitethernet 1/0/3
[SwitchB-GigabitEthernet1/0/3] arp detection trust
[SwitchB-GigabitEthernet1/0/3] quit
# Configure a static IP source guard entry on interface GigabitEthernet 1/0/2.
[SwitchB] interface gigabitethernet 1/0/2
[SwitchB-GigabitEthernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address
0001-0203-0607 vlan 10
[SwitchB-GigabitEthernet1/0/2] quit
# Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP
packets.
[SwitchB] arp detection validate dst-mac ip src-mac
Switch A
Switch B
Host A Host B
GE1/0/3
Vlan-int10
10.1.1.1/24
Gateway
DHCP server
GE1/0/1
GE1/0/3
GE1/0/2
DHCP client
VLAN 10
DHCP snooping
10.1.1.6
0001-0203-0607
To Next Page
Loading...
