386
[SwitchB-Ethernet1/0/3] dhcp-snooping trust
[SwitchB-Ethernet1/0/3] quit
# Enable ARP detection for VLAN 10.
[SwitchB] vlan 10
[SwitchB-vlan10] arp detection enable
# Configure the upstream port as a trusted port (a port is an untrusted port by default).
[SwitchB-vlan10] interface ethernet 1/0/3
[SwitchB-Ethernet1/0/3] arp detection trust
[SwitchB-Ethernet1/0/3] quit
# Configure a static IP source guard binding entry on interface Ethernet 1/0/2.
[SwitchB] interface ethernet 1/0/2
[SwitchB-Ethernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address
0001-0203-0607 vlan 10
[SwitchB-Ethernet1/0/2] quit
# Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP
packets.
[SwitchB] arp detection validate dst-mac ip src-mac
After the configurations are completed, ARP packets received on interfaces Ethernet 1/0/1 and
Ethernet 1/0/2 have their MAC and IP addresses checked first, and then are checked against the
static IP source guard binding entries and finally DHCP snooping entries.
ARP restricted forwarding configuration example
Network requirements
As shown in Figure 120, configure ARP restricted forwarding on Switch B where ARP detection is
configured so that port isolation configured on Switch B can take effect for broadcast ARP requests.
Figure 120 Network diagram
Configuration procedure
1. Configure VLAN 10, add ports to VLAN 10, and configure the IP address of the VLAN-interface,
as shown in Figure 116. (D
etails not shown.)
To Next Page
Loading...
Need help?
General