H3C Routers
Authorized ARP
Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring authorized ARP on a DHCP server 1

Network configuration· 1

Software versions used· 1

Procedures· 1

Configuring the router 1

Configuring the host 2

Verifying the configuration· 2

Configuration files· 3

Example: Configuring authorized ARP on a DHCP relay agent 3

Network configuration· 3

Analysis· 4

Software versions used· 4

Procedures· 4

Configuring Router A· 4

Configuring Router B· 4

Configuring the host 5

Verifying the configuration· 5

Configuration files· 6

Related documentation· 6

 

Introduction

The following information provides examples for configuring authorized ARP on routers.

Prerequisites

This document applies to Comware 9-based routers. Procedures and information in the examples might be slightly different depending on the software or hardware version of the router.

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of authorized ARP.

Example: Configuring authorized ARP on a DHCP server

Network configuration

As shown in Figure 1, configure authorized ARP on GigabitEthernet 0/0/1 of the router (a DHCP server). Then, only hosts with IP addresses assigned by the router can access external networks through the router.

Figure 1 Network diagram

‌

Software versions used

This configuration example was created and verified on R9141P16 of the MSR2630E-X1 device.

Procedures

Configuring the router

# Specify an IP address for GigabitEthernet 0/0/1.

<Router> system-view

[Router] interface gigabitethernet 0/0/1

[Router-GigabitEthernet0/0/1] ip address 10.1.1.1 24

[Router-GigabitEthernet0/0/1] quit

# Enable DHCP.

[Router] dhcp enable

# Specify primary subnet 10.1.1.0/24 in DHCP address pool 1.

[Router] dhcp server ip-pool 1

[Router-dhcp-pool-1] network 10.1.1.0 mask 255.255.255.0

[Router-dhcp-pool-1] quit

# Enable authorized ARP.

[Router] interface gigabitethernet 0/0/1

[Router-GigabitEthernet0/0/1] arp authorized enable

[Router-GigabitEthernet0/0/1] quit

Configuring the host

Configure the NIC of the host to obtain an IP address automatically.

Verifying the configuration

# Verify that the NIC of the host obtains an IP address through DHCP.

C:\Windows\System32>ipconfig

 

Windows IP Configuration

 

 

Ethernet adapter ???? 3:

 

   Connection-specific DNS Suffix    :

   Link-local IPv6 Address           : fe80::d083:44cb:9d9b:71b7%21

   IPv4 Address                      : 10.1.1.2

   Subnet Mask                       : 255.255.255.0

   Default Gateway                   : 10.1.1.1

# Display authorized ARP entry information on the router.

[Router] display arp all

          Type: S-Static    D-Dynamic    M-Multiport    I-Invalid

IP address      MAC address    VLAN     Interface                Aging Type

10.1.1.2        000f-e123-4568 N/A      GE0/0/1                    18    D

The output shows that the router has recorded an authorized ARP entry.

# Disconnect the host from the switch and change the IP address of the host to a static IP address that resides on the same network segment as the router. Verify that the host and the router cannot communicate with each other after you reconnect the host to the switch.

C:\Windows\System32>ping 10.1.1.1

 

Pinging 10.1.1.1 with 32 bytes of data:

Request timed out.

Request timed out.

Request timed out.

Request timed out.

 

Ping statistics for 10.1.1.1:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

# Display authorized ARP entry information on the router.

[Router] display arp all

          Type: S-Static    D-Dynamic    M-Multiport    I-Invalid

IP address      MAC address    VLAN     Interface                Aging Type

Configuration files

#

 dhcp enable

#

dhcp server ip-pool 1

 network 10.1.1.0 mask 255.255.255.0

#

interface GigabitEthernet0/0/1

 port link-mode route

 ip address 10.1.1.1 255.255.255.0

 arp authorized enable

#

Example: Configuring authorized ARP on a DHCP relay agent

Network configuration

As shown in Figure 2, configure authorized ARP on GigabitEthernet 0/0/2 of Router B (a DHCP relay agent) to ensure user validity.

Figure 2 Network diagram

‌

Analysis

Configure recording of relay entries on the relay agent and authorized ARP so that only packets matching a relay entry can be forwarded by the relay agent. In this way, illegal hosts cannot access external networks through the relay agent.

Software versions used

This configuration example was created and verified on R9141P16 of the MSR2630E-X1 device.

Procedures

Configuring Router A

# Specify an IP address for GigabitEthernet 0/0/1.

<RouterA> system-view

[RouterA] interface gigabitethernet 0/0/1

[RouterA-GigabitEthernet0/0/1] ip address 10.1.1.1 24

[RouterA-GigabitEthernet0/0/1] quit

# Enable DHCP.

[RouterA] dhcp enable

# Specify primary subnet 10.10.1.0/24 in DHCP address pool 1.

[RouterA] dhcp server ip-pool 1

[RouterA-dhcp-pool-1] network 10.10.1.0 mask 255.255.255.0

[RouterA-dhcp-pool-1] gateway-list 10.10.1.1

[RouterA-dhcp-pool-1] quit

#Configure a static route.

[RouterA] ip route-static 10.10.1.0 24 10.1.1.2

Configuring Router B

# Enable DHCP.

<RouterB> system-view

[RouterB] dhcp enable

# Specify IP addresses for GigabitEthernet 0/0/1 and GigabitEthernet 0/0/2.

[RouterB] interface gigabitethernet 0/0/1

[RouterB-GigabitEthernet0/0/1] ip address 10.1.1.2 24

[RouterB-GigabitEthernet0/0/1] quit

[RouterB] interface GigabitEthernet 0/0/2

[RouterB-GigabitEthernet0/0/2] ip address 10.10.1.1 24

# Enable the DHCP relay agent on GigabitEthernet 0/0/2.

[RouterB-GigabitEthernet0/0/2] dhcp select relay

# Specify the IP address of the DHCP server on the relay agent.

[RouterB-GigabitEthernet0/0/2] dhcp relay server-address 10.1.1.1

# Enable authorized ARP.

[RouterB-GigabitEthernet0/0/2] arp authorized enable

[RouterB-GigabitEthernet0/0/2] quit

# Enable the recording of relay entries on the relay agent.

[RouterB] dhcp relay client-information record

Configuring the host

Configure the NIC of the host to obtain an IP address automatically.

Verifying the configuration

# Verify that the NIC of the host obtains an IP address through DHCP.

C:\Windows\System32>ipconfig

 

Windows IP Configuration

 

 

Ethernet adapter ???? 3:

 

   Connection-specific DNS Suffix    :

   Link-local IPv6 Address           : fe80::d083:44cb:9d9b:71b7%21

   IPv4 Address                      : 10.10.1.2

   Subnet Mask                       : 255.255.255.0

   Default Gateway                   : 10.10.1.1

# Display authorized ARP entry information on Router B.

[RouterB] display arp all

          Type: S-Static    D-Dynamic    M-Multiport    I-Invalid

IP address      MAC address    VLAN     Interface                Aging Type

10.1.1.1        0cda-41c7-057e N/A      GE0/0/1                  15    D

10.10.1.2       0066-61e2-f7f2 N/A      GE0/0/2                         20    D  

#Disconnect the host from Router B and change the IP address of the host to a static IP address that resides on the same network segment as Router B. Verify that the host and Router B cannot communicate with each other after you reconnect the host to Router B.

C:\Windows\System32> ping 10.10.1.1

 

Pinging 10.10.1.1 with 32 bytes of data:

Request timed out.

Request timed out.

Request timed out.

Request timed out.

 

Ping statistics for 10.10.1.1:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

# Display authorized ARP entry information on Router B.

[RouterB] display arp all

          Type: S-Static    D-Dynamic    M-Multiport    I-Invalid

IP address      MAC address    VLAN     Interface                Aging Type

10.1.1.1        0cda-41c7-057e N/A      GE0/0/1                  15    D

Configuration files

·     Router A:

#

 dhcp enable

#

dhcp server ip-pool 1 

 network 10.10.1.0 mask 255.255.255.0

 gateway-list 10.10.1.1

#

interface GigabitEthernet0/0/1

 port link-mode route

 combo enable copper

 ip address 10.1.1.1 255.255.255.0

# 

 ip route-static 10.10.1.0 24 10.1.1.2

#

·     Router B:

#

 dhcp enable

dhcp relay client-information record 

#

interface GigabitEthernet0/0/1

 port link-mode route

 ip address 10.1.1.2 255.255.255.0

#   

interface GigabitEthernet0/0/2

 port link-mode route

 ip address 10.10.1.1 255.255.255.0

 arp authorized enable

 dhcp select relay

 dhcp relay server-address 10.1.1.1

#

Related documentation

·     Layer 3—IP Services Configuration Guide in H3C MSR1000[2600][3600] Routers Configuration Guides(V9)

·     Layer 3—IP Services Command Reference in H3C MSR1000[2600][3600] Routers Command References(V9)

·     Security Configuration Guide in H3C MSR1000[2600][3600] Routers Configuration Guides(V9)

·     Security Command Reference in H3C MSR1000[2600][3600] Routers Command References(V9)