Table of Contents

1 ARP Configuration Guide· 1-1

ARP Attack Detection and Packet Rate Limit Configuration Example· 1-1

Network Diagram·· 1-1

Networking and Configuration Requirements· 1-1

Applicable Product Matrix· 1-1

Configuration procedure· 1-2

Complete Configuration· 1-2

Precautions· 1-3

Proxy ARP Configuration Example· 1-3

Network diagram·· 1-3

Network requirements· 1-3

Applicable Product Matrix· 1-4

Configuration procedure· 1-4

Complete Configuration· 1-4

Precautions· 1-4

Proxy ARP Configuration in Port Isolation Application· 1-5

Network diagram·· 1-5

Network requirements· 1-5

Applicable Product Matrix· 1-5

Configuration procedure· 1-5

Complete Configuration· 1-6

Precautions· 1-6

 

ARP Attack Detection and Packet Rate Limit Configuration Example

Network Diagram

Figure 1-1 ARP attack detection and packet rate limit configuration

 

Networking and Configuration Requirements

As shown in Figure 1-1, Ethernet 1/0/1 of Switch A connects to DHCP Server; Ethernet 1/0/2 connects to Client A, Ethernet 1/0/3 connects to Client B. Ethernet 1/0/1, Ethernet 1/0/2 and Ethernet 1/0/3 belong to VLAN 1.

l          Enable DHCP snooping on Switch A and specify Ethernet 1/0/1 as the DHCP snooping trusted port.

l          Enable ARP attack detection in VLAN 1 to prevent ARP man-in-the-middle attacks, and specify Ethernet 1/0/1 as the ARP trusted port.

l          Enable the ARP packet rate limit function on Ethernet 1/0/2 and Ethernet 1/0/3 of Switch A, so as to prevent Client A and Client B from attacking Switch A through ARP traffic.

l          Enable the port state auto recovery function on the ports of Switch A, and set the recovery interval to 200 seconds.

l          Configuration Procedure

Applicable Product Matrix

Product series	Software version	Hardware version
S5600 series Ethernet switches	Release 1602	All versions
S3600-SI/EI series Ethernet switches	Release 1602	All versions
S3100-EI series Ethernet switches	Release 2104, Release 2107	All versions
S3100-52P	Release 1602	S3100-52P

 

Configuration procedure

# Enable DHCP snooping on Switch A.

<SwitchA> system-view

[SwitchA] dhcp-snooping

# Specify Ethernet 1/0/1 as the DHCP snooping trusted port and the ARP trusted port.

[SwitchA] interface Ethernet1/0/1

[SwitchA-Ethernet1/0/1] dhcp-snooping trust

[SwitchA-Ethernet1/0/1] arp detection trust

[SwitchA-Ethernet1/0/1] quit

# Enable ARP attack detection on all ports in VLAN 1.

[SwitchA] vlan 1

[SwitchA-vlan1] arp detection enable

# Enable the ARP packet rate limit function on Ethernet 1/0/2, and set the maximum ARP packet rate allowed on the port to 20 pps.

[SwitchA] interface Ethernet1/0/2

[SwitchA-Ethernet1/0/2] arp rate-limit enable

[SwitchA-Ethernet1/0/2] arp rate-limit 20

[SwitchA-Ethernet1/0/2] quit

# Enable the ARP packet rate limit function on Ethernet 1/0/3, and set the maximum ARP packet rate allowed on the port to 50 pps.

[SwitchA] interface Ethernet1/0/3

[SwitchA-Ethernet1/0/3] arp rate-limit enable

[SwitchA-Ethernet1/0/3] arp rate-limit 50

[SwitchA-Ethernet1/0/3] quit

# Configure the port state auto recovery function, and set the recovery interval to 200 seconds.

[SwitchA] arp protective-down recover enable

[SwitchA] arp protective-down recover interval 200

Complete Configuration

#

 arp protective-down recover enable

 arp protective-down recover interval 200

#

vlan 1

 arp detection enable

#

interface Ethernet1/0/1

 dhcp-snooping trust

 arp detection trust

#

interface Ethernet1/0/2

 arp rate-limit enable

 arp rate-limit 20

#

interface Ethernet1/0/3

 arp rate-limit enable

 arp rate-limit 50

#

 dhcp-snooping

#

Precautions

l          You need to enable DHCP snooping and configure DHCP snooping trusted ports on the switch before configuring the ARP attack detection function.

l          You need to enable the port state auto-recovery feature before you can configure the port state auto-recovery interval.

l          Generally, the uplink port of a switch is configured as a trusted port.

l          You are not recommended to configure ARP attack detection or ARP packet rate limit function on the ports of a fabric or an aggregation group.

Proxy ARP Configuration Example

Network diagram

Figure 1-2 Network diagram for proxy ARP

 

Network requirements

l          Host A belongs to VLAN 1, and the IP address of Host A is 192.168.10.100/16, Host D belongs to VLAN 2, and the IP address of Host D is 192.168.20.100/16.

l          The IP address of VLAN-interface 1 is 192.168.10.99/24, and that of VLAN-interface 2 is 192.168.20.99/24.

l          Enable proxy ARP on VLAN-interface 1 and VLAN-interface 2 to realize the communication between Host A and Host D.

Applicable Product Matrix

Product series	Software version	Hardware version
S5600 series Ethernet switches	Release 1602	All versions
S3600-SI/EI series Ethernet switches	Release 1602	All versions

 

Configuration procedure

# Configure the IP address of VLAN-interface 1 to be 192.168.10.99/24, and enable proxy ARP on VLAN-interface 1.

<Switch> system-view

[Switch] interface vlan-interface 1

[Switch-Vlan-interface1] ip address 192.168.10.99 255.255.255.0

[Switch-Vlan-interface1] arp proxy enable

[Switch-Vlan-interface1] quit

# Configure the IP address of VLAN-interface 2 to be 192.168.20.99/24, and enable proxy ARP on VLAN-interface 2.

[Switch] interface vlan-interface 2

[Switch-Vlan-interface2] ip address 192.168.20.99 255.255.255.0

[Switch-Vlan-interface2] arp proxy enable

[Switch-Vlan-interface2] quit

Complete Configuration

#

interface Vlan-interface1

 arp proxy enable

 ip address 192.168.10.99 255.255.255.0

#

interface Vlan-interface2

 arp proxy enable

 ip address 192.168.20.99 255.255.255.0

#

Precautions

None

Proxy ARP Configuration in Port Isolation Application

Network diagram

Figure 1-3 Network diagram for Proxy ARP configuration in port isolation application

 

Network requirements

l          Switch A is connected to Switch B through Ethernet 1/0/1.

l          Ethernet 1/0/2 and Ethernet 1/0/3 on Switch B belong to the same VLAN but are assigned to the port isolation group. The two ports are connected to Host A and Host B respectively.

l          Configure proxy ARP on Switch A to enable Host A and Host B isolated at Layer 2 to communicate with each other at Layer 3.

Applicable Product Matrix

Product series	Software version	Hardware version
S5600 series Ethernet switches	Release 1602	All versions
S3600-SI/EI series Ethernet switches	Release 1602	All versions

 

Configuration procedure

1)        Configure Switch B

# Add Ethernet 1/0/1, Ethernet 1/0/2 and Ethernet 1/0/3 to VLAN 2.

<SwitchB> system-view

[SwitchB] vlan 2

[SwitchB-vlan2] port ethernet 1/0/1

[SwitchB-vlan2] port ethernet 1/0/2

[SwitchB-vlan2] port ethernet 1/0/3

[SwitchB-vlan2] quit

# Disable Host A and Host B from communicating with each other at Layer 2.

For details about port isolation, refer to the part discussing port isolation.

[SwitchB] interface ethernet 1/0/2

[SwitchB-Ethernet1/0/2] port isolate

[SwitchB-Ethernet1/0/2] quit

[SwitchB] interface ethernet 1/0/3

[SwitchB-Ethernet1/0/3] port isolate

[SwitchB-Ethernet1/0/3] quit

2)        Configure Switch A

# Configure the IP address of VLAN-interface 2 to be 192.168.10.100/24.

[SwitchA] vlan 2

[SwitchA-vlan2] port ethernet 1/0/1

[SwitchA-vlan2] quit

[SwitchA] interface vlan-interface 2

[SwitchA-Vlan-interface2] ip address 192.168.10.100 255.255.0.0

# Configure proxy ARP on VLAN-interface 2, enabling Host A and Host B to communicate at Layer 3.

[SwitchA-Vlan-interface2] arp proxy enable

[SwitchA-Vlan-interface2] quit

Complete Configuration

1)        Configuration on Switch B

#

vlan 2

#

interface Ethernet1/0/1

 port access vlan 2

#

interface Ethernet1/0/2

 port access vlan 2

 port isolate

#

interface Ethernet1/0/3

 port access vlan 2

 port isolate

#

2)        Configuration on Switch A

#

vlan 2

#

interface Vlan-interface2

 arp proxy enable

 ip address 192.168.10.100 255.255.0.0

#

interface Ethernet1/0/1

 port access vlan 2

#

Precautions

For details about port isolation, refer to the part discussing port isolation.