Configuring arp gateway protection – H3C Technologies H3C WX3000E Series Wireless Switches User Manual
Page 354
340
[AC-wlan-ap-2100] serial-id 210235A29G007C000020
# Bind the WLAN service template to radio 1, and enable the radio.
[AC-wlan-ap-2100] radio 1
[AC-wlan-ap-2100-radio-1] service-template 1
[AC-wlan-ap-2100-radio-1] radio enable
# The ports connecting the AC and APs reside in VLAN 1 by default. Configure the IP address of
the VLAN interface on the AC and APs. (Details not shown.)
# Enable DHCP snooping.
<AC> system-view
[AC] dhcp-snooping
[AC] interface GigabitEthernet 1/0/1
[AC-GigabitEthernet 1/0/1] dhcp-snooping trust
[AC-GigabitEthernet 1/0/1] quit
# Enable ARP detection for VLAN 10 to check user validity.
[AC] vlan 10
[AC-vlan10] arp detection enable
# Configure the upstream port as a trusted port and the downstream ports as untrusted ports (a port
is an untrusted port by default).
[AC-vlan10] interface GigabitEthernet 1/0/1
[AC-GigabitEthernet1/0/1] arp detection trust
[AC-GigabitEthernet1/0/1] quit
# Enable ARP packet validity check.
[AC] arp detection validate dst-mac ip src-mac
After the configuration, the AC will first check the validity of ARP packets received on the
WLAN-ESS interface, and then check the ARP packets against DHCP snooping entries.
Configuring ARP gateway protection
Configure this feature on interfaces not connected with the gateway to prevent gateway spoofing attacks.
When such a port receives an ARP packet, it checks whether the sender IP address in the packet is
consistent with that of any protected gateway. If yes, it discards the packet. If not, it handles the packet
normally.
To configure ARP gateway protection:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter Layer 2 Ethernet interface view or
WLAN-ESS interface view.
interface interface-type
interface-number
N/A
3.
Enable ARP gateway protection for a
specified gateway.
arp filter source ip-address
Disabled by default