Contents

Configuring WLAN IP snooping· 1

Overview·· 1

Client IPv4 address learning· 1

Client IPv6 address learning· 1

WLAN IP snooping configuration task list 2

Disabling snooping ARP packets· 2

Disabling snooping ND packets· 2

Disabling SNMP from getting client IPv6 addresses learned from ND packets· 2

Enabling snooping HTTP requests redirected to the portal server 3

WLAN IP snooping configuration example· 3

Network requirements· 3

Configuration procedure· 3

Configuring WLAN IP snooping

Overview

WLAN IP snooping enables an AP to learn clients' IP addresses through snooping ARP, DHCP, and HTTP packets and generate snooping entries that record IP addresses, MAC addresses, and learning method. The entries will be used by IP Source Guard to determine whether to forward client packets. For more information about IP Source Guard, see Security Configuration Guide.

Client IPv4 address learning

An AP learns client IPv4 addresses by using the following methods:

·     Snooping DHCPv4 packets exchanged between client and server.

For more information about DHCP, see Layer 3—IP Services Configuration Guides.

·     Snooping ARP packets sent by clients.

For more information about ARP, see Layer 3—IP Services Configuration Guides.

·     Snooping HTTP requests redirected to the portal server.

For more information about portal authentication, see Security Configuration Guides.

The priorities for learning IP addresses through snooping DHCPv4 packets, ARP packets, and HTTP requests are in descending order.

Client IPv6 address learning

An AP learns client IPv6 addresses by using the following methods:

·     Snooping DHCPv6 packets exchanged between client and server.

For more information about DHCPv6, see Layer 3—IP Services Configuration Guides.

·     Snooping ND packets, including Router Advertisement (RA) packets, Neighbor Solicitation (NS) packets, and Neighbor Advertisement (NA) packets sent by clients.

For more information about ND, see Layer 3—IP Services Configuration Guides.

·     Snooping HTTP requests redirected to the portal server.

For more information about portal authentication, see Security Configuration Guides.

The priorities for learning IPv6 addresses through snooping DHCPv6 packets, ND packets, and HTTP requests are in descending order.

WLAN IP snooping configuration task list

Disabling snooping ARP packets

About ARP packet snooping

By default, an AP learns client IPv4 addresses by snooping ARP and DHCPv4 packets. Perform this task to disable client IPv4 address learning from ARP packets.

Procedure

Disabling snooping ND packets

Disabling SNMP from getting client IPv6 addresses learned from ND packets

This feature enables SNMP to obtain only client IPv6 addresses learned from DHCPv6 packets.

To disable SNMP from getting client IPv6 addresses learned from ND packets:

Enabling snooping HTTP requests redirected to the portal server

The AC can use this method to learn IP addresses of portal-authenticated clients.

To enable snooping HTTP requests redirected to the portal server:

WLAN IP snooping configuration example

Network requirements

As shown in Figure 1, configure the AP to learn the client's IPv6 address only from DHCPv6 packets.

Figure 1 Network diagram

Configuration procedure

# Configure wireless services. (Details not shown.)

For more information, see "Managing APs" and "Configuring WLAN access."

# Disable snooping ND packets.

<AC> system-view

[AC] wlan service-template service

[AC-wlan-st-service] undo client ipv6-snooping nd-learning enable