Configuration Guide Configuring ARP Check
The ARP Check has two modes: Enabled and Disabled. The default is Enabled.
17. Enabled Mode
Through ARP Check, ARP packets are detected based on the IP/IP-MAC based binding information provided by the
following modules.
Global IP-MAC binding
802.1X authorization
IP Source Guard
GSN binding
Port security
Web authentication
Port security IP+MAC or IP binding
When only ARP Check is enabled on a port but the above-mentioned modules are not enabled, legal user information
cannot be generated, and thereby all ARP packets from this port will be discarded.
When ARP check is enabled on a port, if VRRP is also enabled on the same port, both physical and virtualaddresses of
the port can server as gateway. Physical IP address and VRRP IP address of this port should be configurated, or the
ARP packets sent to the gateway may be filtered.
18. Disabled Mode
ARP packets on a port are not checked.
Overview
Check the source IP and source MAC addresses of ARP packets to filter out illegal ARP packets.
5.3.1 Filtering ARP Packets
Enable ARP Check on specified ports to realize filtration of illegal ARP packets.
Working Principle
A device matches the source IP and source MAC addresses of the ARP packets received at its ports with the legal user
information of the device. With successful matching, packets will be transferred, or otherwise they will be discarded.
Related Configuration
Enabling ARP Check on Ports
By default, the ARP Check is disabled on ports.
Use the arp-check command to enable ARP Check.
Unless otherwise noted, this function is usually configured on the ports of access devices.
To Next Page
Loading...
Need help?
General
