HP 6125G HP 6125G & 6125G/XG Blade Switches Layer 3 - IP Services Conf - Page 26

Configuring ARP snooping, Overview, Configuration procedure, Displaying and maintaining ARP snooping

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 26 highlights

Configuring ARP snooping Overview The ARP snooping feature is used in Layer 2 switching networks. It creates ARP snooping entries using ARP packets, and the entries can be used by manual-mode MFF to answer ARP requests from a gateway. For more information about MFF, see Security Configuration Guide. If ARP snooping is enabled on a VLAN of a device, ARP packets received by the interfaces of the VLAN are redirected to the CPU. The CPU uses ARP packets to create ARP snooping entries comprising source IP and MAC addresses, VLAN and receiving port information. The aging time and valid period of an ARP snooping entry are 25 minutes and 15 minutes, respectively. If an ARP snooping entry is not updated within 15 minutes, it becomes invalid and cannot be used. After that, if an ARP packet whose source IP and MAC addresses correspond with the entry is received, the entry becomes valid, and its age timer restarts. If the age timer of an ARP entry expires, the entry is removed. If the ARP snooping device receives an ARP packet that has the same sender IP address as but a different sender MAC address from a valid ARP snooping entry, it considers that an attack occurs. An ARP snooping entry conflict occurs in this case. As a result, the ARP snooping entry becomes invalid and is removed after 25 minutes. Configuration procedure To enable ARP snooping for a VLAN: Step 1. Enter system view. 2. Enter VLAN view. 3. Enable ARP snooping. Command system-view vlan vlan-id arp-snooping enable Remarks N/A N/A Disabled by default Displaying and maintaining ARP snooping Task Display ARP snooping entries. Remove ARP snooping entries. Command Remarks display arp-snooping [ ip ip-address | vlan vlan-id ] [ | { begin | exclude | include } regular-expression ] Available in any view reset arp-snooping [ ip ip-address | vlan vlan-id ] Available in user view 18

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
18
Configuring ARP snooping
Overview
The ARP snooping feature is used in Layer 2 switching networks. It creates ARP snooping entries using
ARP packets, and the entries can be used by manual-mode MFF to answer ARP requests from a gateway.
For more information about MFF, see
Security Configuration Guide
.
If ARP snooping is enabled on a VLAN of a device, ARP packets received by the interfaces of the VLAN
are redirected to the CPU. The CPU uses ARP packets to create ARP snooping entries comprising source
IP and MAC addresses, VLAN and receiving port information.
The aging time and valid period of an ARP snooping entry are 25 minutes and 15 minutes, respectively.
If an ARP snooping entry is not updated within 15 minutes, it becomes invalid and cannot be used. After
that, if an ARP packet whose source IP and MAC addresses correspond with the entry is received, the
entry becomes valid, and its age timer restarts. If the age timer of an ARP entry expires, the entry is
removed.
If the ARP snooping device receives an ARP packet that has the same sender IP address as but a different
sender MAC address from a valid ARP snooping entry, it considers that an attack occurs. An ARP
snooping entry conflict occurs in this case. As a result, the ARP snooping entry becomes invalid and is
removed after 25 minutes.
Configuration procedure
To enable ARP snooping for a VLAN:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter VLAN view.
vlan
vlan-id
N/A
3.
Enable ARP snooping.
arp-snooping enable
Disabled by default
Displaying and maintaining ARP snooping
Task
Command
Remarks
Display ARP snooping entries.
display arp-snooping
[
ip
ip-address
|
vlan
vlan-id
] [
|
{
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Remove ARP snooping entries.
reset arp-snooping
[
ip
ip-address
|
vlan
vlan-id
]
Available in user view