ARP restricted forwarding configuration example

As shown in Figure 122, configure ARP restricted forwarding on Switch B where ARP attack detection is configured. Port isolation configured on Switch B can take effect for broadcast ARP requests.

1. Configure VLAN 10, add interfaces to VLAN 10, and specify the IP address of the VLAN interface. (Details not shown.)

2. Configure the DHCP server on Switch A, and configure DHCP address pool 0.

   <SwitchA> system-view
   [SwitchA] dhcp enable
   [SwitchA] dhcp server ip-pool 0
   [SwitchA-dhcp-pool-0] network 10.1.1.0 mask 255.255.255.0
   

3. Configure Host A (DHCP client) and Host B. (Details not shown.)

4. Configure Switch B:

   # Enable DHCP snooping, and configure GigabitEthernet 1/0/3 as a DHCP-trusted port.

   <SwitchB> system-view
   [SwitchB] dhcp snooping enable
   [SwitchB] interface gigabitethernet 1/0/3
   [SwitchB-GigabitEthernet1/0/3] dhcp snooping trust
   [SwitchB-GigabitEthernet1/0/3] quit
   

   # Enable ARP attack detection for user validity check.

   [SwitchB] vlan 10
   [SwitchB-vlan10] arp detection enable
   

   # Configure GigabitEthernet 1/0/3 as an ARP-trusted port.

   [SwitchB-vlan10] interface gigabitethernet 1/0/3
   [SwitchB-GigabitEthernet1/0/3] arp detection trust
   [SwitchB-GigabitEthernet1/0/3] quit
   

   # Configure a static IP source guard entry on interface GigabitEthernet 1/0/2.

   [SwitchB] interface gigabitethernet 1/0/2
   [SwitchB-GigabitEthernet1/0/2] ip source binding ip-address 10.1.1.6 mac-address 0001-0203-0607 vlan 10
   [SwitchB-GigabitEthernet1/0/2] quit
   

   # Enable ARP packet validity check by checking the MAC addresses and IP addresses of ARP packets.

   [SwitchB] arp detection validate dst-mac ip src-mac
   

   # Configure port isolation.

   [SwitchB] port-isolate group 1
   [SwitchB] interface gigabitethernet 1/0/1
   [SwitchB-GigabitEthernet1/0/1] port-isolate enable group 1
   [SwitchB-GigabitEthernet1/0/1] quit
   [SwitchB] interface gigabitethernet 1/0/2
   [SwitchB-GigabitEthernet1/0/2] port-isolate enable group 1
   [SwitchB-GigabitEthernet1/0/2] quit
   

   After the configurations are completed, Switch B first checks the validity of ARP packets received on interfaces GigabitEthernet 1/0/1 and GigabitEthernet 1/0/2. If the ARP packets are confirmed as valid, the switch performs user validity check by using the static IP source guard bindings and DHCP snooping entries. However, ARP broadcast requests sent from Host A can pass the check on Switch B and reach Host B. Port isolation fails.

   # Enable ARP restricted forwarding.

   [SwitchB] vlan 10
   [SwitchB-vlan10] arp restricted-forwarding enable
   [SwitchB-vlan10] quit
   

   After the configuration is completed, Switch B forwards ARP broadcast requests from Host A to Switch A through the trusted interface GigabitEthernet 1/0/3. Host B cannot receive such packets. Port isolation works correctly.