HP A5120 EI Series User manual

HP A5120 EI Switch Series
Layer 3 - IP Services
Configuration Guide
Abstract
This document describes the software features for the HP A Series products and guides you through the
software configuration procedures. These configuration guides also provide configuration examples to
help you apply software features to different network scenarios.
This documentation is intended for network planners, field technical support and servicing engineers, and
network administrators working with the HP A Series products.
Part number: 5998-1795
Software version: Release 2208
Document version: 5W100-20110530

Legal and notice information
© Copyright 2011 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or use
of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

iii
Contents
ARP configuration ···························································································································································· 1
ARP overview·····································································································································································1
ARP function······························································································································································1
ARP message format ················································································································································1
Operation of ARP ·····················································································································································2
ARP table···································································································································································3
Configuring ARP································································································································································3
Configuring a static ARP entry································································································································3
Configuring the maximum number of dynamic ARP entries for an interface·····················································4
Setting the age timer for dynamic ARP entries······································································································4
Enabling dynamic ARP entry check························································································································5
Configuring ARP quick update ·······························································································································5
Displaying and maintaining ARP ····································································································································6
ARP configuration example··············································································································································6
Gratuitous ARP configuration ········································································································································· 8
Introduction to gratuitous ARP··········································································································································8
Configuring gratuitous ARP··············································································································································8
Proxy ARP configuration ···············································································································································10
Proxy ARP overview······················································································································································· 10
Proxy ARP······························································································································································· 10
Local Proxy ARP····················································································································································· 11
Enabling proxy ARP······················································································································································· 11
Displaying and maintaining proxy ARP ······················································································································ 12
Proxy ARP configuration examples ······························································································································ 12
Proxy ARP configuration example ······················································································································· 12
Local proxy ARP configuration example in case of port isolation ··································································· 13
Local proxy ARP configuration example in isolate-user-VLAN·········································································· 14
IP addressing configuration ··········································································································································17
IP addressing overview·················································································································································· 17
IP address classes·················································································································································· 17
Special IP addresses ············································································································································· 18
Subnetting and masking······································································································································· 18
Configuring IP addresses ·············································································································································· 19
Assigning an IP address to an interface ············································································································· 19
IP addressing configuration example·················································································································· 19
Displaying and maintaining IP addressing ················································································································· 21
DHCP overview······························································································································································22
Introduction to DHCP ····················································································································································· 22
DHCP address allocation ·············································································································································· 22
Allocation mechanisms ········································································································································· 22
Dynamic IP address allocation process ·············································································································· 23
IP address lease extension ··································································································································· 23
DHCP message format ·················································································································································· 24
DHCP options ································································································································································· 25
Overview································································································································································ 25
Introduction to DHCP options······························································································································· 25
Self-defined options··············································································································································· 25

iv
Protocols and standards················································································································································ 28
DHCP server configuration ···········································································································································30
Introduction to DHCP server·········································································································································· 30
Application environment······································································································································· 30
DHCP address pool··············································································································································· 30
IP address allocation sequence···························································································································· 31
DHCP server configuration task list······························································································································ 31
Configuring an address pool for the DHCP server····································································································· 32
Configuration task list ··········································································································································· 32
Creating a DHCP address pool··························································································································· 32
Configuring an address allocation mode for a common address pool ·························································· 33
Configuring dynamic address allocation for an extended address pool························································ 35
Configuring a domain name suffix for the client ······························································································· 36
Configuring DNS servers for the client ··············································································································· 36
Configuring WINS servers and NetBIOS node type for the client ·································································· 36
Configuring BIMS server information for the client ··························································································· 37
Configuring gateways for the client ···················································································································· 37
Configuring Option 184 parameters for the client with voice service ···························································· 38
Configuring the TFTP server and bootfile name for the client··········································································· 38
Configuring self-defined DHCP options ·············································································································· 39
Enabling DHCP ······························································································································································ 40
Enabling the DHCP server on an interface·················································································································· 40
Applying an extended address pool on an interface ································································································ 41
Configuring the DHCP server security functions ········································································································· 41
Configuration prerequisites ·································································································································· 41
Enabling unauthorized DHCP server detection·································································································· 42
Configuring IP address conflict detection ··········································································································· 42
Enabling Option 82 handling ······································································································································ 42
Specifying the threshold for sending trap messages·································································································· 43
Configuration prerequisites ·································································································································· 43
Configuration procedure ······································································································································ 43
Displaying and maintaining the DHCP server ············································································································ 44
DHCP server configuration examples ·························································································································· 44
Static IP address assignment configuration example ························································································ 45
Dynamic IP address assignment configuration example··················································································· 46
Self-defined option configuration example········································································································· 47
Troubleshooting DHCP server configuration ··············································································································· 48
DHCP relay agent configuration··································································································································50
Introduction to DHCP relay agent ································································································································ 50
Application environment······································································································································· 50
Fundamentals························································································································································· 50
DHCP relay agent support for Option 82 ·········································································································· 51
DHCP relay agent configuration task list····················································································································· 52
Enabling DHCP ······························································································································································ 52
Enabling the DHCP relay agent on an interface ········································································································ 52
Correlating a DHCP server group with a relay agent interface ··············································································· 53
Configuring the DHCP relay agent security functions ································································································ 54
Creating static bindings and enabling address check······················································································ 54
Configuring periodic refresh of dynamic client entries ····················································································· 54
Enabling unauthorized DHCP server detection·································································································· 55
Enabling DHCP starvation attack protection ······································································································ 55
Enabling offline detection·············································································································································· 56
Configuring the DHCP relay agent to release an IP address···················································································· 56
Configuring the DHCP relay agent to support Option 82························································································· 57

v
Displaying and maintaining the DHCP relay agent ··································································································· 58
DHCP relay agent configuration examples················································································································· 59
DHCP relay agent configuration example·········································································································· 59
DHCP relay agent Option 82 support configuration example········································································· 60
Troubleshooting DHCP relay agent configuration······································································································ 61
DHCP client configuration·············································································································································62
Introduction to DHCP client··········································································································································· 62
Enabling the DHCP client on an interface··················································································································· 62
Displaying and maintaining the DHCP client·············································································································· 62
DHCP client configuration example····························································································································· 63
DHCP snooping configuration······································································································································65
DHCP snooping overview ············································································································································· 65
Functions of DHCP snooping ······························································································································· 65
Application environment of trusted ports ············································································································ 66
DHCP snooping support for Option 82·············································································································· 67
DHCP snooping configuration task list ························································································································ 68
Configuring DHCP snooping basic functions·············································································································· 68
Configuring DHCP snooping to support Option 82··································································································· 69
Configuring DHCP snooping entries backup·············································································································· 70
Enabling DHCP starvation attack protection··············································································································· 71
Enabling DHCP-REQUEST message attack protection ······························································································· 72
Configuring DHCP packet rate limit····························································································································· 72
Displaying and maintaining DHCP snooping ············································································································· 73
DHCP snooping configuration examples····················································································································· 73
DHCP snooping configuration example ············································································································· 73
DHCP snooping Option 82 support configuration example ············································································ 74
BOOTP client configuration··········································································································································76
Introduction to BOOTP client ········································································································································ 76
BOOTP application··············································································································································· 76
Obtaining an IP address dynamically················································································································· 76
Protocols and standards ······································································································································· 76
Configuring an interface to dynamically obtain an IP address through BOOTP ···················································· 77
Displaying and maintaining BOOTP client configuration·························································································· 77
BOOTP client configuration example ·························································································································· 77
IPv4 DNS configuration ················································································································································78
DNS overview ································································································································································ 78
Static domain name resolution ···························································································································· 78
Dynamic domain name resolution······················································································································· 78
DNS proxy ····························································································································································· 79
DNS spoofing ························································································································································ 80
Configuring the IPv4 DNS client ·································································································································· 81
Configuring static domain name resolution········································································································ 81
Configuring dynamic domain name resolution·································································································· 82
Configuring the DNS proxy ·········································································································································· 83
Configuring DNS spoofing ··········································································································································· 83
Configuration prerequisites ·································································································································· 83
Configuration procedure ······································································································································ 83
Displaying and maintaining IPv4 DNS························································································································ 83
IPv4 DNS configuration examples ······························································································································· 84
Static domain name resolution configuration example····················································································· 84
Dynamic domain name resolution configuration example ··············································································· 85
DNS proxy configuration example······················································································································ 88
Troubleshooting IPv4 DNS configuration ···················································································································· 89

vi
IPv6 DNS configuration ················································································································································90
Introduction to IPv6 DNS··············································································································································· 90
Configuring the IPv6 DNS client ·································································································································· 90
Configuring static domain name resolution········································································································ 90
Configuring dynamic domain name resolution·································································································· 90
Displaying and maintaining IPv6 DNS························································································································ 91
IPv6 DNS configuration examples ······························································································································· 91
Static domain name resolution configuration example ····················································································· 91
Dynamic domain name resolution configuration example ··············································································· 92
IP performance optimization configuration·················································································································98
IP performance optimization overview ························································································································ 98
Enabling reception and forwarding of directed broadcasts to a directly connected network ······························ 98
Enabling reception of directed broadcasts to a directly connected network·················································· 98
Enabling forwarding of directed broadcasts to a directly connected network··············································· 98
Configuration example ········································································································································· 99
Configuring TCP attributes ··········································································································································100
Configuring the TCP send/receive buffer size·································································································100
Configuring TCP timers·······································································································································100
Configuring ICMP to send error packets ···················································································································100
Introduction ··························································································································································100
Configuration procedure ····································································································································102
Displaying and maintaining IP performance optimization ······················································································102
IRDP configuration ······················································································································································ 104
IRDP overview·······························································································································································104
Background··························································································································································104
Working mechanism···········································································································································104
Terminology ·························································································································································105
Protocols and standards ·····································································································································105
Configuring IRDP··························································································································································105
IRDP configuration example········································································································································106
UDP Helper configuration ·········································································································································· 109
Introduction to UDP Helper ·········································································································································109
Configuring UDP Helper ·············································································································································109
Displaying and maintaining UDP Helper ··················································································································110
UDP Helper configuration example ···························································································································110
IPv6 basics configuration··········································································································································· 112
IPv6 overview ·······························································································································································112
IPv6 features·························································································································································112
IPv6 addresses·····················································································································································113
IPv6 neighbor discovery protocol······················································································································116
IPv6 PMTU discovery ··········································································································································118
IPv6 transition technologies································································································································119
Protocols and standards ·····································································································································120
IPv6 basics configuration task list·······························································································································120
Configuring basic IPv6 functions································································································································121
Enabling IPv6·······················································································································································121
Configuring an IPv6 global unicast address ····································································································121
Configuring an IPv6 link-local address ·············································································································123
Configure an IPv6 anycast address ··················································································································124
Configuring IPv6 ND ···················································································································································125
Configuring a static neighbor entry ··················································································································125
Configuring the maximum number of neighbors dynamically learned ·························································125

vii
Configuring parameters related to RA messages ····························································································126
Configuring the maximum number of attempts to send an NS message for DAD·······································128
Setting the age timer for ND entries··················································································································129
Configuring ND snooping··································································································································129
Enabling ND proxy ·············································································································································130
Configuring PMTU discovery······································································································································131
Configuring a static PMTU for a specified IPv6 address ················································································131
Configuring the aging time for dynamic PMTUs······························································································132
Configuring IPv6 TCP properties ································································································································132
Configuring ICMPv6 packet sending·························································································································133
Configuring the maximum ICMPv6 error packets sent in an interval ····························································133
Enabling replying to multicast echo requests ···································································································133
Enabling sending of ICMPv6 time exceeded messages ·················································································133
Enabling sending of ICMPv6 destination unreachable messages ·································································134
Displaying and maintaining IPv6 basics configuration····························································································135
IPv6 configuration example ········································································································································136
Troubleshooting IPv6 basics configuration················································································································141
DHCPv6 overview······················································································································································· 142
Introduction to DHCPv6···············································································································································142
DHCPv6 address/prefix assignment··························································································································142
Rapid assignment involving two messages ······································································································142
Assignment involving four messages·················································································································142
Address/Prefix lease renewal ····································································································································143
Stateless DHCPv6 configuration ·································································································································144
Introduction ··························································································································································144
Operation·····························································································································································145
Protocols and standards··············································································································································145
DHCPv6 server configuration ···································································································································· 146
Introduction to the DHCPv6 server ·····························································································································146
Application environment·····································································································································146
Basic concepts ·····················································································································································146
Prefix selection process·······································································································································147
DHCPv6 server configuration task list························································································································148
Configuration prerequisites·········································································································································148
Enabling the DHCPv6 server ······································································································································148
Creating a prefix pool·················································································································································148
Configuring a DHCPv6 address pool························································································································148
Applying the address pool to an interface················································································································149
Displaying and maintaining the DHCPv6 server ······································································································150
DHCPv6 server configuration example ·····················································································································150
DHCPv6 relay agent configuration··························································································································· 154
Introduction to the DHCPv6 relay agent····················································································································154
Application environment·····································································································································154
Operation of DHCPv6 relay agent····················································································································154
Configuring the DHCPv6 relay agent ························································································································155
Configuration prerequisites ································································································································155
Configuration procedure ····································································································································155
Displaying and maintaining the DHCPv6 relay agent·····························································································156
DHCPv6 relay agent configuration example ············································································································156
DHCPv6 client configuration ····································································································································· 159
Introduction to the DHCPv6 client ······························································································································159
Configuring the DHCPv6 client ··································································································································159
Configuration prerequisites ································································································································159

viii
Configuration procedure ····································································································································159
Displaying and maintaining the DHCPv6 client ·······································································································159
Stateless DHCPv6 configuration example ·················································································································160
DHCPv6 snooping configuration ······························································································································ 162
DHCPv6 snooping overview·······································································································································162
Enabling DHCPv6 snooping ·······································································································································163
Configuring a DHCPv6 snooping trusted port··········································································································163
Configuring the maximum number of DHCPv6 Snooping entries an interface can learn ···································164
Displaying and maintaining DHCPv6 snooping·······································································································164
DHCPv6 snooping configuration example················································································································164
Network requirements·········································································································································164
Configuration procedure ····································································································································165
Support and other resources ····································································································································· 166
Contacting HP ······························································································································································166
Subscription service ············································································································································166
Related information······················································································································································166
Documents····························································································································································166
Websites ······························································································································································166
Conventions ··································································································································································167
Index············································································································································································· 169

1
ARP configuration
ARP overview
ARP function
The Address Resolution Protocol (ARP) is used to resolve an IP address into a physical address (Ethernet
MAC address, for example).
In an Ethernet LAN, a switch uses ARP to resolve the IP address of the next hop to the corresponding
MAC address.
ARP message format
ARP messages include ARP requests and ARP replies. Figure 1 shows the format of the ARP request/reply.
Numbers in the figure refer to field lengths.
Figure 1 ARP message format
28-byte ARP request/reply
OP Sender hardware
address Sender protocol address Target hardware
address Target protocol
address
Protocol
type
22 61 442 61
Hardware address length
Protocol address length
Hardware
type
The following describe the fields in Figure 1.
Hardware type: The hardware address type. The value 1 represents Ethernet.
Protocol type: The type of the protocol address to be mapped. The hexadecimal value 0x0800
represents IP.
Hardware address length and protocol address length: Length, in bytes, of a hardware address and
protocol address. For an Ethernet address, the value of the hardware address length field is 6. For
an IP(v4) address, the value of the protocol address length field is 4.
OP: Operation code. The type of the ARP message. The value 1 represents an ARP request and 2
represents an ARP reply.
Sender hardware address: Hardware address of the switch sending the message.
Sender protocol address: Protocol address of the switch sending the message.
Target hardware address: Hardware address of the switch the message is being sent to.
Target protocol address: Protocol address of the switch the message is being sent to.

2
Operation of ARP
If Host A and Host B are on the same subnet and Host A sends a packet to Host B, as shown in Figure 2:
1. Host A looks in its ARP table to see whether there is an ARP entry for Host B. If yes, Host A uses the
MAC address in the entry to encapsulate the IP packet into a data link layer frame and sends the
frame to Host B.
2. If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request using
the following information.
Source IP address and source MAC address: Host A’s own IP address and the MAC address
Target IP address: Host B’s IP address
Target MAC address: An all-zero MAC address
Because the ARP request is broadcast, all hosts on this subnet can receive the request, but only the
requested host (Host B) will process the request.
3. Host B compares its own IP address with the target IP address in the ARP request. If they are the
same, Host B:
Adds the sender IP address and sender MAC address into its ARP table.
Encapsulates its MAC address into an ARP reply.
Unicasts the ARP reply to Host A.
4. After receiving the ARP reply, Host A:
Adds the MAC address of Host B into its ARP table.
Encapsulates the MAC address in the IP packet and sends it to Host B.
Figure 2 ARP address resolution process
Target IP
address
192.168.1.1
Target IP
address
192.168.1.2
Host A
192.168.1.1
0002-6779-0f4c
Host B
192.168.1.2
00a0-2470-febd
Target MAC
address
0000-0000-0000
Sender MAC
address
00a0-2470-febd
Target MAC
address
0002-6779-0f4c
Sender IP
address
192.168.1.1
Sender MAC
address
0002-6779-0f4c
Sender IP
address
192.168.1.2
If Host A and Host B are not on the same subnet:
5. Host A sends an ARP request to the gateway. The target IP address in the ARP request is the IP
address of the gateway.
6. After obtaining the MAC address of the gateway from an ARP reply, Host A sends the packet to the
gateway.
7. If the gateway maintains the ARP entry of Host B, it forwards the packet to Host B directly; if not, it
broadcasts an ARP request, in which the target IP address is the IP address of Host B.
8. After obtaining the MAC address of Host B, the gateway sends the packet to Host B.

3
ARP table
After obtaining a host’s MAC address, the switch adds the IP-to-MAC mapping to its own ARP table. This
mapping is used for forwarding packets with the same destination in the future.
An ARP table contains dynamic and static ARP entries.
Dynamic ARP entry
A dynamic entry is automatically created and maintained by ARP. It can age out, be updated by a new
ARP packet, and be overwritten by a static ARP entry. A dynamic ARP entry is removed when its age
timer expires or the interface goes down.
Static ARP entry
A static ARP entry is manually configured and maintained. It does not age out and cannot be overwritten
by a dynamic ARP entry.
Static ARP entries protect communication between devices, because attack packets cannot modify the IP-
to-MAC mapping in a static ARP entry.
Static ARP entries can be long or short.
A long static ARP entry can be directly used to forward packets directly, because it includes not only
the IP address and MAC address, but also a configured VLAN and outbound interface.
A short static ARP entry includes only an IP address and a MAC address. It cannot be used to
forward data directly if the outbound interface is a VLAN interface. When a short static ARP entry
matches an IP packet to be forwarded, the switch sends an ARP request first. If the sender IP and
MAC addresses in the received ARP reply match the IP and MAC addresses of the short static ARP
entry, the switch adds the interface receiving the ARP reply to the short static ARP entry. Then the
entry can be used for forwarding IP packets.
NOTE:
Usually ARP dynamically resolves IP addresses to MAC addresses without manual intervention.
To allow communication with a host using a fixed IP-to-MAC mapping, configure a short static ARP entry for it.
To allow communication with a host using a fixed IP-to-MAC mapping through a specific interface in a specific
VLAN, configure a long static ARP entry for it.
Configuring ARP
Configuring a static ARP entry
A static ARP entry is effective when the device it corresponds to works normally. However, when a VLAN
or VLAN interface is deleted, any static ARP entry corresponding to it will also be deleted (if it is a long
static ARP entry) or will become unresolved (if it is a short and resolved static ARP entry).
Follow these steps to configure a static ARP entry:
To do…
Use the command…
Remarks
Enter system view
system-view
—

4
To do…
Use the command…
Remarks
Configure a long static
ARP entry
arp static ip-address mac-address
vlan-id interface-type interface-
number
Required
No long static ARP entry is configured by
default.
Configure a short static
ARP entry
arp static ip-address mac-address
Required
No short static ARP entry is configured by
default.
CAUTION:
The vlan-id argument must be the ID of an existing VLAN that corresponds to the ARP entries. In addition, the
Ethernet interface following the argument must belong to that VLAN. A VLAN interface must be created for the
VLAN.
The IP address of the VLAN interface corresponding to the vlan-id argument must belong to the same subnet as
the IP address specified by the ip-address argument.
Configuring the maximum number of dynamic ARP entries for
an interface
Follow these steps to set the maximum number of dynamic ARP entries that an interface can learn:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter Ethernet interface view
interface interface-type interface-
number
—
Set the maximum number of
dynamic ARP entries that an
interface can learn
arp max-learning-num number
Optional
1024 by default.
If the value of the number argument is
set to 0, the interface is disabled from
learning dynamic ARP entries.
Setting the age timer for dynamic ARP entries
Each dynamic ARP entry in the ARP table has a limited lifetime, called its age timer. The age timer of a
dynamic ARP entry is reset each time the dynamic ARP entry is used. Dynamic ARP entries that are not
used before expiration are deleted from the ARP table. You can adjust the age timers for dynamic ARP
entries.
Follow these steps to set the age timer for dynamic ARP entries:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Set the age timer for dynamic ARP
entries
arp timer aging aging-time
Optional
20 minutes by default.

5
Enabling dynamic ARP entry check
The dynamic ARP entry check function controls whether the switch supports dynamic ARP entries with
multicast MAC addresses.
When dynamic ARP entry check is enabled, the switch cannot learn dynamic ARP entries containing
multicast MAC addresses.
When dynamic ARP entry check is disabled, the switch can learn dynamic ARP entries containing
multicast MAC addresses.
Follow these steps to enable ARP entry check:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enable dynamic ARP entry
check
arp check enable
Optional
Enabled by default.
Configuring ARP quick update
As shown in Figure 3, the laptop frequently roams between AP 1 and AP 2. This affects the mapping
between its MAC address and outbound interface on the switch. If the switch does not update its ARP
table immediately after the outbound interface changes, it may fail to communicate with the laptop.
Figure 3 ARP quick update application scenario
G1/0/1
Laptop
AP1 AP2
G1/0/2
Switch
With ARP quick update enabled, the switch updates the corresponding ARP entry immediately after the
change of the mapping between a MAC address and an outbound interface to ensure nonstop data
forwarding.
Follow these steps to enable ARP quick update:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enable ARP quick update
mac-address station-move quick-
notify enable
Optional
Disabled by default.

6
NOTE:
HP recommends enabling ARP quick update in WLANs only.
Displaying and maintaining ARP
To do…
Use the command…
Remarks
Display ARP entries in the ARP
table
display arp [ [ all | dynamic | static ] [ slot
slot-number ] | vlan vlan-id | interface
interface-type interface-number ] [ count ] [ |
{ begin | exclude | include } regular-
expression ]
Available in any view
Display the ARP entry for a
specified IP address
display arp ip-address [slot slot-number ] [ |
{begin |exclude |include } regular-
expression ]
Available in any view
Display the age timer for dynamic
ARP entries
display arp timer aging [ |{ begin |
exclude | include } regular-expression ]
Available in any view
Clear ARP entries from the ARP
table
reset arp { all | dynamic | static | slot slot-
number | interface interface-type interface-
number }
Available in user view
NOTE:
Clearing ARP entries from the ARP table may cause communication failures.
ARP configuration example
Network requirements
As shown in Figure 4, hosts are connected to the switch, which is connected to the router through
interface GigabitEthernet 1/0/1 belonging to VLAN 10. The IP address of the router is 192.168.1.1/24.
The MAC address of the router is 00e0-fc01-0000.
To prevent malicious users from attacking the switch and enhance security for communications between
the router and the switch, configure a static ARP entry for the router on the switch.

7
Figure 4 Network diagram for configuring static ARP entries
Router
Switch
GE1/0/1
VLAN 10
192.168.1.1/24
00e0-fc01-0000
Configuration procedure
Configure the switch
# Create VLAN 10.
<Switch> system-view
[Switch] vlan 10
[Switch-vlan10] quit
# Add interface GigabitEthernet 1/0/1 to VLAN 10.
[Switch] interface GigabitEthernet 1/0/1
[Switch-GigabitEthernet1/0/1] port link-type trunk
[Switch-GigabitEthernet1/0/1] port trunk permit vlan 10
[Switch-GigabitEthernet1/0/1] quit
# Create interface VLAN-interface 10 and configure its IP address.
[Switch] interface vlan-interface 10
[Switch-vlan-interface10] ip address 192.168.1.2 24
[Switch-vlan-interface10] quit
# Configure a static ARP entry with IP address 192.168.1.1 and MAC address 00e0-fc01-0000. The
outgoing interface corresponding to the static ARP entry is GigabitEthernet 1/0/1 belonging to VLAN
10.
[Switch] arp static 192.168.1.1 00e0-fc01-0000 10 GigabitEthernet 1/0/1
# Display information about static ARP entries.
[Switch] display arp static
Type: S-Static D-Dynamic A-Authorized
IP Address MAC Address VLAN ID Interface Aging Type
192.168.1.1 00e0-fc01-0000 10 GE1/0/1 N/A S

8
Gratuitous ARP configuration
Introduction to gratuitous ARP
In a gratuitous ARP packet, the sender IP address and the target IP address are both the IP address of the
switch issuing the packet, the sender MAC address is the MAC address of the switch, and the target MAC
address is the broadcast address ff:ff:ff:ff:ff:ff.
A switch sends gratuitous ARP packets for the following purposes:
To determine whether its IP address is already used by another device. If the IP address is already
used, the device issuing the gratuitous ARP packet is informed of the conflict by an ARP reply.
To inform other devices of a change of its MAC address so they can update their ARP entries.
Enabling learning of gratuitous ARP packets
With this feature enabled, a switch receiving a gratuitous ARP packet adds the sender IP and MAC
addresses carried in the packet to its ARP table if no corresponding ARP entry exists. If a corresponding
ARP entry is found, the switch updates the ARP entry.
After this feature is disabled, the switch will use the address information in the received gratuitous ARP
packets to update the existing ARP entries only, but not to create new ARP entries.
Configuring periodic sending of gratuitous ARP packets
Enabling a switch to periodically send gratuitous ARP packets helps downstream devices update their
corresponding ARP entries or MAC entries. This feature can be used to prevent gateway spoofing and
prevent ARP entries from aging out.
Prevent gateway spoofing
When an attacker sends forged gratuitous ARP packets to the hosts on a network, the traffic destined for
the gateway from the hosts is sent to the attacker instead. As a result, the hosts cannot access the external
network.
To prevent gateway spoofing attacks, enable the gateway to send gratuitous ARP packets containing its
primary IP address and manually configured secondary IP addresses at a specific interval, so hosts can
learn correct gateway address information.
Prevent ARP entries from aging out
If network traffic is heavy or if a host’s CPU usage is high, received ARP packets may be discarded or not
processed in time. Eventually, the dynamic ARP entries on the receiving host age out, and the traffic
between the host and the corresponding devices is interrupted until the host re-creates the ARP entries.
To prevent this problem, enable the gateway to send gratuitous ARP packets periodically. The gratuitous
ARP packets contain the gateway's primary IP address or one of its manually configured secondary IP
addresses, so the receiving hosts can update ARP entries in time, ensuring traffic continuity.
Configuring gratuitous ARP
Follow these steps to configure gratuitous ARP:

9
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enable learning of gratuitous ARP
packets
gratuitous-arp-learning enable
Optional
Enabled by default.
Enable the switch to send
gratuitous ARP packets upon
receiving ARP requests from
another subnet
gratuitous-arp-sending enable
Required
By default, the switch does not
send gratuitous ARP packets upon
receiving ARP requests from
another subnet.
Enter interface view
interface interface-type interface-
number
—
Enable periodic sending of
gratuitous ARP packets and set the
sending interval
arp send-gratuitous-arp [ interval
milliseconds ]
Required
Disabled by default.
NOTE:
You can enable periodic sending of gratuitous ARP packets on a maximum of 1024 interfaces.
Periodic sending of gratuitous ARP packets takes effect only when the link of the enabled interface goes up and
an IP address has been assigned to the interface.
If you change the interval for sending gratuitous ARP packets, the configuration is effective at the next sending
interval.
The frequency of sending gratuitous ARP packets may be much lower than is expected if this function is enabled
on multiple interfaces, if each interface is configured with multiple secondary IP addresses, or if a small sending
interval is configured in such cases.

10
Proxy ARP configuration
Proxy ARP overview
Proxy ARP includes common proxy ARP and local proxy ARP.
Common proxy ARP allows communication when a sending host considers the receiving host to be
on the same subnet, but the receiving host actually resides on a different subnet.
Local proxy ARP allows communication between hosts that reside on the same subnet but are
isolated at Layer 2.
In both cases, a device located between the two hosts must respond with the MAC address of the
receiving interface, to allow Layer 3 communication between the two hosts. This is achieved by proxy
ARP, which hides the physical details of the network.
Proxy ARP involves common proxy ARP and local proxy ARP, which are described in the following
sections.
NOTE:
The term proxy ARP in the following sections of this chapter refers to common proxy ARP unless
otherwise specified.
Proxy ARP
A proxy ARP enabled device allows hosts that reside on different subnets to communicate.
As shown in Figure 5, a switch connects to two subnets through VLAN-interface 1 and VLAN-interface 2.
The IP addresses of the two interfaces are 192.168.10.99/24 and 192.168.20.99/24. Host A and Host B
are assigned the same prefix 192.168.0.0. Host A connects to VLAN-interface 1 and Host B connects to
VLAN-interface 2.
Figure 5 Application environment of proxy ARP
192.168.10.100/16 192.168.20.200/16
Vlan-int1
192.168.10.99/24 Vlan-int2 192.168.20.99/24
Host A Host B
Switch
Because Host A and Host B have the same prefix 192.168.0.0, Host A considers that Host B is on the
same network, and it broadcasts an ARP request for the MAC address of Host B. Host B, however, cannot
receive this request because it is in a different broadcast domain.
You can enable proxy ARP on VLAN-interface 1 of the switch so that the switch can reply to the ARP
request from Host A with the MAC address of VLAN-interface 1, and forward packets sent from Host A to
Host B. In this case, the switch acts like a proxy of Host B.
A main advantage of proxy ARP is that you can enable it on a single switch without disturbing routing
tables of other switches in the network. Proxy ARP acts as the gateway for hosts that are not configured
with a default gateway or do not have routing capability.

11
Local Proxy ARP
As shown in Figure 6, Host A and Host B belong to VLAN 2, but are isolated at Layer 2. Host A connects
to GigabitEthernet 1/0/3 while Host B connects to GigabitEthernet 1/0/1. Enable local proxy ARP on
switch A to allow Layer 3 communication between the two hosts.
Figure 6 Application environment of local proxy ARP
VLAN 2
Vlan-int2
192.168.10.100/16
Switch B
GE1/0/3 GE1/0/1
GE1/0/2
Host A
192.168.10.99/16 Host B
192.168.10.200/16
VLAN 2
port-isolate group
Switch A
In each of the following cases, you must enable local proxy ARP:
Hosts connecting to different isolated Layer 2 ports in the same VLAN need to communicate at Layer
3.
If an isolate-user-VLAN is configured, hosts in different secondary VLANs of the isolate-user-VLAN
need to communicate at Layer 3.
Enabling proxy ARP
Follow these steps to enable proxy ARP in VLAN interface view:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter interface view
interface interface-type interface-
number
—
Enable proxy ARP
proxy-arp enable
Required
Disabled by default.
Follow these steps to enable local proxy ARP in VLAN interface view:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter interface view
interface interface-type interface-
number
—
Enable local proxy ARP
local-proxy-arp enable [ ip-range
startIP to endIP ]
Required
Disabled by default.

12
Displaying and maintaining proxy ARP
To do…
Use the command…
Remarks
Display whether proxy ARP is
enabled
display proxy-arp [interface interface-type
interface-number ] [ |{ begin | exclude |
include } regular-expression ]
Available in any view
Display whether local proxy ARP
is enabled
display local-proxy-arp [interface
interface-type interface-number ] [ |{
begin | exclude | include } regular-
expression ]
Available in any view
Proxy ARP configuration examples
Proxy ARP configuration example
Network requirements
As shown in Figure 7, Host A and Host D have the same prefix and mask (IP addresses of Host A and
Host D are 192.168.10.100/16 and 192.168.20.200/16 respectively), but they are located on different
subnets separated. Host A belongs to VLAN 1 and Host D belongs to VLAN 2. As a result, Host D cannot
receive or respond to any ARP request from Host A.
To enable communication between the two hosts, configure proxy ARP on the switch.
Figure 7 Network diagram for proxy ARP
Vlan-int1
192.168.10.99/24
192.168.10.100/16
0000.0c94.36aa
192.168.20.200/16
0000.0c94.36dd
Switch
Subnet B
Subnet A
Host A Host B
Host C Host D
Vlan-int2
192.168.20.99/24
Configuration procedure
# Create VLAN 2.
<Switch> system-view
[Switch] vlan 2
[Switch-vlan2] quit