Figure 1 Trusted ports for dynamic ARP protection
Follow these configuration guidelines when using dynamic ARP protection in your network:
•
Configure ports connected to other switches in the network as trusted ports. Thus all network
switches can exchange ARP packets and update their ARP caches with valid information.
•
Separate switches that do not support dynamic ARP protection by a router in their own Layer
2 domain. Because ARP packets do not cross Layer 2 domains, unprotected switches cannot
unknowingly accept ARP packets from an attacker and forward them to protected switches
through trusted ports.
To configure one or more Ethernet interfaces that handle VLAN traffic as trusted ports, enter the
arp-protect trust
command at the global configuration level. The switch does not check ARP
requests and responses received on a trusted port.
Syntax:
[
no
]
arp-protect trust <port-list>
Detail
Task
Parameter
Separate individual port numbers or ranges of port
numbers with a comma (for example,
13-15, 17
).
Specifies a port number or
a range of port numbers.
port-list
Example:
HP Switch(config)# arp-protect trust 5-8, 17
Adding an IP-to-MAC binding to the DHCP binding database and adding or removing
a static binding
A routing switch maintains a DHCP binding database used for DHCP and ARP packet validation.
Both the DHCP snooping and DHCP Option 82 insertion features maintain the lease database by
learning the IP-to-MAC bindings on untrusted ports. Each binding consists of the client MAC address,
port number, VLAN identifier, leased IP address, and lease time.
If your network does not use DHCP or if some network devices have fixed, user-configured IP
addresses, you can enter static IP-to-MAC address bindings in the DHCP binding database. The
switch uses manually configured static bindings for DHCP snooping and dynamic ARP protection.
To add the static configuration of an IP-to-MAC binding for a port to the database, enter the
ip
source-binding
command at the global configuration level.
Dynamic ARP protection
17
