235
[SwitchB] interface gigabitethernet 1/0/3
[SwitchB-GigabitEthernet1/0/3] dhcp-snooping trust
[SwitchB-GigabitEthernet1/0/3] quit
# Enable ARP detection for VLAN 10.
[SwitchB] vlan 10
[SwitchB-vlan10] arp detection enable
# Configure the upstream port as a trusted port and the downstream ports as untrusted ports (a port is an
untrusted port by default).
[SwitchB-vlan10] interface gigabitethernet 1/0/3
[SwitchB-GigabitEthernet1/0/3] arp detection trust
[SwitchB-GigabitEthernet1/0/3] quit
# Configure a static IP source guard binding entry on interface GigabitEthernet 1/0/2.
[SwitchB] interface gigabitethernet 1/0/2
[SwitchB-GigabitEthernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address 0001-
0203-0607 vlan 10
[SwitchB-GigabitEthernet1/0/2] quit
# Enable the checking of the MAC addresses and IP addresses of ARP packets.
[SwitchB] arp detection validate dst-mac ip src-mac
After the preceding configurations are complete, when ARP packets arrive at interfaces GigabitEthernet
1/0/1 and GigabitEthernet 1/0/2, their MAC and IP addresses are checked, and then the packets are
checked against the static IP source guard binding entries and, finally, DHCP snooping entries.
ARP restricted forwarding configuration example
Network requirements
As shown in Figure 77, Switch A acts as a DHCP server. Host A acts as a DHCP client. Host B’s IP
address is 10.1.1.6, and its MAC address is 0001-0203-0607. Port isolation configured on Switch B
isolates the two hosts at Layer 2, which can communicate with the gateway Switch A. GigabitEthernet
1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 belong to VLAN 10. Switch B is enabled
with DHCP snooping and has ARP detection enabled in VLAN 10.
Configure Switch B to still perform port isolation on ARP broadcast requests.
To Next Page
Loading...
Need help?
General