Configuring Arp Active Acknowledgement - HP 10500 Series Configuration Manual

Figure 99 Network diagram
ARP attack protection
Host A
Configuration considerations
An attacker may forge a large number of ARP packets by using the MAC address of a valid host as the
source MAC address. To prevent such attacks, configure the gateway as follows:
1. Enable source MAC-based ARP attack detection and specify the handling method.
2. Set the threshold.
3. Set the lifetime for ARP attack entries.
4. Exclude the MAC address of the server from this detection
Configuration procedure
# Enable source MAC-based ARP attack detection and specify the handling method.
<Device> system-view
[Device] arp source-mac filter
# Set the threshold to 30.
[Device] arp source-mac threshold 30
# Set the lifetime for ARP attack entries to 60 seconds.
[Device] arp source-mac aging-time 60
# Exclude 0012-3f86-e94c from this detection.
[Device] arp source-mac exclude-mac 0012-3f86-e94c

Configuring ARP active acknowledgement

Configure this feature on gateway devices to prevent user spoofing.
ARP active acknowledgement prevents a gateway from generating incorrect ARP entries. For more
information about its working mechanism, see ARP Attack Protection Technology White Paper.
IP network
Gateway
Device
Host B Host C
256
Server
0012-3f 86-e 94c
Host D