User validity check and ARP packet validity check configuration example

As shown in Figure 121, configure DHCP snooping on Switch B, and enable ARP attack detection in VLAN 10. Switch B performs ARP packet validity check and user validity check based on static IP source guard bindings and DHCP snooping entries for connected hosts.

1. Add all interfaces on Switch B to VLAN 10, and specify the IP address of VLAN-interface 10 on Switch A. (Details not shown.)

2. Configure the DHCP server on Switch A, and configure DHCP address pool 0.

   <SwitchA> system-view
   [SwitchA] dhcp enable
   [SwitchA] dhcp server ip-pool 0
   [SwitchA-dhcp-pool-0] network 10.1.1.0 mask 255.255.255.0
   

3. Configure Host A (DHCP client) and Host B. (Details not shown.)

4. Configure Switch B:

   # Enable DHCP snooping.

   <SwitchB> system-view
   [SwitchB] dhcp snooping enable
   [SwitchB] interface gigabitethernet 1/0/3
   [SwitchB-GigabitEthernet1/0/3] dhcp snooping trust
   [SwitchB-GigabitEthernet1/0/3] quit
   

   # Enable recording of client information in DHCP snooping entries on GigabitEthernet 1/0/1.

   [SwitchB] interface gigabitethernet 1/0/1
   [SwitchB-GigabitEthernet1/0/1] dhcp snooping binding record
   [SwitchB-GigabitEthernet1/0/1] quit
   

   # Enable ARP attack detection for VLAN 10.

   [SwitchB] vlan 10
   [SwitchB-vlan10] arp detection enable
   

   # Configure the upstream interface as a trusted interface. By default, an interface is an untrusted interface.

   [SwitchB-vlan10] interface gigabitethernet 1/0/3
   [SwitchB-GigabitEthernet1/0/3] arp detection trust
   [SwitchB-GigabitEthernet1/0/3] quit
   

   # Configure a static IP source guard binding on interface GigabitEthernet 1/0/2 for user validity check.

   [SwitchB] interface gigabitethernet 1/0/2
   [SwitchB-GigabitEthernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address 0001-0203-0607 vlan 10
   [SwitchB-GigabitEthernet1/0/2] quit
   

   # Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP packets.

   [SwitchB] arp detection validate dst-mac ip src-mac
   

   After the configurations are completed, Switch B first checks the validity of ARP packets received on GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2. If the ARP packets are confirmed as valid, the switch performs user validity check by using the static IP source guard bindings and finally DHCP snooping entries.