HPE FlexNetwork 5130 EI Series User manual

HPE FlexNetwork 5130 EI Switch Series
Layer 3—IP Services
Configuration Guide
Part number: 5200-3942
Software version: Release 32xx
Document version: 6W100-20170525

© Copyright 2015, 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
Adobe® andAcrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ARP··············································································1
About ARP ·······························································································································1
ARP message format···········································································································1
ARP operating mechanism····································································································1
ARP entry types··················································································································2
ARP tasks at a glance·················································································································3
Configuring a static ARP entry······································································································3
Configuring a short static ARP entry························································································4
Configuring a long static ARP entry·························································································4
Configuring a multiport ARP entry···························································································4
Configuring features for dynamic ARP entries ··················································································5
Setting the dynamic ARP learning limit for a device ····································································5
Setting the dynamic ARP learning limit for an interface································································5
Setting the aging timer for dynamic ARP entries·········································································6
Enabling dynamic ARP entry check·························································································6
Enabling ARP logging·················································································································7
Display and maintenance commands for ARP··················································································7
ARP configuration examples ········································································································8
Example: Configuring a long static ARP entry············································································8
Example: Configuring a short static ARP entry···········································································9
Example: Configuring a multiport ARP entry··············································································9
Configuring gratuitous ARP······························································12
About gratuitous ARP ···············································································································12
IP conflict detection············································································································12
Gratuitous ARP packet learning····························································································12
Periodic sending of gratuitous ARP packets············································································12
Gratuitous ARP tasks at a glance································································································13
Enabling IP conflict notification····································································································13
Enabling gratuitous ARP packet learning ······················································································13
Enabling periodic sending of gratuitous ARP packets·······································································13
Enabling sending gratuitous ARP packets for ARP requests with sender IP address on a different subnet ··14
Configuring gratuitous ARP packet retransmission for the device MAC address change··························14
Configuring proxy ARP····································································15
About proxy ARP ·····················································································································15
Enabling common proxy ARP·····································································································15
Enabling local proxy ARP ··········································································································15
Display and maintenance commands for proxy ARP········································································15
Common proxy ARP configuration example···················································································16
Example: Configuring common proxy ARP··············································································16
Configuring ARP snooping·······························································18
About ARP snooping ················································································································18
Creation of ARP snooping entries ·························································································18
Aging of ARP snooping entries·····························································································18
Protection for ARP snooping································································································18
Enabling ARP snooping·············································································································18
Display and maintenance commands for ARP snooping···································································18
Configuring ARP direct route advertisement·········································20
About ARP direct route advertisement··························································································20
Mechanism of ARP direct route advertisement·········································································20
Enabling ARP direct route advertisement······················································································20
Configuring IP addressing································································21
About IP addressing ·················································································································21

ii
IP address representation and classes···················································································21
Special IP addresses ·········································································································22
Subnetting and masking ·····································································································22
IP address assignment·······································································································22
Assigning an IP address to an interface························································································23
Display and maintenance commands for IP addressing····································································23
IP addressing configuration examples ··························································································24
Example: Manually specifying an IP address···········································································24
DHCP overview ·············································································26
DHCP network model ···············································································································26
DHCP address allocation···········································································································26
Allocation mechanisms·······································································································26
IP address allocation process ······························································································27
IP address lease extension··································································································27
DHCP message format ·············································································································28
DHCP options ·························································································································29
Common DHCP options ············································································································29
Custom DHCP options··············································································································29
Vendor-specific option (Option 43) ························································································30
Relay agent option (Option 82)·····························································································31
Option 184·······················································································································31
Protocols and standards············································································································32
Configuring the DHCP server····························································33
About DHCP server··················································································································33
DHCP address assignment mechanisms················································································33
Principles for selecting an address pool··················································································34
IP address allocation sequence····························································································35
DHCP server tasks at a glance ···································································································35
Creating a DHCP user class·······································································································36
Configuring an address pool on the DHCP server ···········································································36
DHCP address pool tasks at a glance····················································································36
Creating a DHCP address pool ····························································································36
Specifying a primary subnet and multiple address ranges in a DHCP address pool ·························37
Specifying a primary subnet and multiple secondary subnets in a DHCP address pool·····················38
Configuring a static binding in a DHCP address pool·································································39
Specifying gateways for DHCP clients ···················································································40
Specifying a domain name suffix for DHCP clients····································································41
Specifying DNS servers for DHCP clients···············································································41
Specifying WINS servers and NetBIOS node type for DHCP clients ·············································41
Specifying BIMS server for DHCP clients················································································42
Specifying the configuration file for DHCP client automatic configuration·······································42
Specifying a server for DHCP clients ·····················································································43
Configuring Option 184 parameters for DHCP clients································································43
Customizing DHCP options ·································································································44
Configuring the DHCP user class whitelist ··············································································46
Applying an address pool to an interface·······················································································46
Configuring a DHCP policy for dynamic assignment ········································································47
Enabling DHCP ·······················································································································47
Enabling the DHCP server on an interface ····················································································48
Configuring IP address conflict detection·······················································································48
Enabling handling of Option 82 ···································································································49
Configuring the DHCP server security features···············································································49
Restrictions and guidelines··································································································49
Configuring DHCP starvation attack protection ········································································49
Configuring DHCP server compatibility·························································································50
Configuring the DHCP server to always broadcast responses·····················································50
Configuring the DHCP server to ignore BOOTP requests···························································50
Configuring the DHCP server to send BOOTP responses in RFC 1048 format ·······························51
Setting the DSCP value for DHCP packets sent by the DHCP server··················································51
Configuring DHCP binding auto backup························································································51

iii
Enabling client offline detection on the DHCP server ·······································································52
Configuring address pool usage alarming······················································································52
Enabling DHCP logging on the DHCP server ·················································································53
Display and maintenance commands for DHCP server ····································································53
DHCP server configuration examples···························································································54
Example: Configuring static IP address assignment··································································54
Example: Configuring dynamic IP address assignment······························································55
Example: Configuring DHCP user class ·················································································57
Example: Configuring DHCP user class whitelist······································································59
Example: Configuring primary and secondary subnets ······························································60
Example: Customizing DHCP option ·····················································································61
Troubleshooting DHCP server configuration ··················································································63
Failure to obtain a non-conflicting IP address ··········································································63
Configuring the DHCP relay agent·····················································64
About DHCP relay agent ···········································································································64
DHCP relay agent operation ································································································64
DHCP relay agent support for Option 82·················································································65
DHCP relay agent tasks at a glance·····························································································65
Enabling DHCP ·······················································································································66
Enabling the DHCP relay agent on an interface··············································································66
Specifying DHCP servers ··········································································································66
Specifying DHCP servers on a relay agent··············································································66
Configuring a DHCP address pool on a DHCP relay agent·························································67
Specifying the DHCP server selecting algorithm·······································································67
Configuring the DHCP relay agent security features ········································································69
Enabling the DHCP relay agent to record relay entries ······························································69
Enabling periodic refresh of dynamic relay entries····································································69
Enabling DHCP starvation attack protection············································································70
Enabling DHCP server proxy on the DHCP relay agent ·····························································71
Enabling client offline detection on the DHCP relay agent ··························································71
Configuring the DHCP relay agent to release an IP address······························································72
Configuring DHCP relay agent support for Option 82·······································································72
Setting the DSCP value for DHCP packets sent by the DHCP relay agent············································73
Specifying the DHCP relay agent address for the giaddr field ···························································73
Manually specifying the DHCP relay agent address for the giaddr field·········································73
Configuring smart relay to specify the DHCP relay agent address for the giaddr field ······················74
Specifying the source IP address for relayed DHCP requests····························································74
Display and maintenance commands for DHCP relay agent······························································75
DHCP relay agent configuration examples ····················································································75
Example: Configuring basic DHCP relay agent ········································································75
Example: Configuring Option 82···························································································76
Example: Configuring DHCP server selection··········································································77
Troubleshooting DHCP relay agent configuration············································································78
Failure of DHCP clients to obtain configuration parameters through the DHCP relay agent ···············78
Configuring the DHCP client·····························································79
About DHCP client ···················································································································79
Restrictions and guidelines: DHCP client configuration·····································································79
DHCP client tasks at a glance·····································································································79
Enabling the DHCP client on an interface······················································································79
Configuring a DHCP client ID for an interface·················································································80
Enabling duplicated address detection··························································································80
Setting the DSCP value for DHCP packets sent by the DHCP client ···················································81
Display and maintenance commands for DHCP client······································································81
DHCP client configuration examples ····························································································81
Example: Configuring DHCP client························································································81
Configuring DHCP snooping·····························································84
About DHCP snooping··············································································································84
Application of trusted and untrusted ports···············································································84
DHCP snooping support for Option 82 ···················································································85

iv
Restrictions and guidelines: DHCP snooping configuration ·······························································86
DHCP snooping tasks at a glance ·······························································································86
Configuring basic DHCP snooping features ···················································································86
Configuring basic DHCP snooping features in a common network ···············································86
Configuring DHCP snooping support for Option 82··········································································88
Configuring DHCP snooping entry auto backup··············································································89
Setting the maximum number of DHCP snooping entries··································································89
Configuring DHCP packet rate limit······························································································90
Configuring DHCP snooping security features················································································90
Enabling DHCP starvation attack protection············································································90
Enabling DHCP-REQUEST attack protection ··········································································91
Configuring a DHCP packet blocking port···············································································91
Enabling DHCP snooping logging································································································92
Disabling DHCP snooping on an interface·····················································································92
Display and maintenance commands for DHCP snooping·································································93
DHCP snooping configuration examples·······················································································93
Example: Configuring basic DHCP snooping features globally ····················································93
Example: Configuring basic DHCP snooping features for a VLAN················································94
Example: Configuring DHCP snooping support for Option 82······················································95
Configuring the BOOTP client···························································97
About BOOTP client ·················································································································97
BOOTP client application····································································································97
Obtaining an IP address dynamically·····················································································97
Protocols and standards ·····································································································97
Configuring an interface to use BOOTP for IP address acquisition······················································97
Display and maintenance commands for BOOTP client····································································98
BOOTP client configuration examples ··························································································98
Example: Configuring BOOTP client······················································································98
Configuring DNS············································································99
About DNS·····························································································································99
Types of DNS services·······································································································99
Static domain name resolution ·····························································································99
Dynamic domain name resolution ·························································································99
DNS proxy····················································································································· 100
DNS spoofing················································································································· 101
DNS tasks at a glance············································································································· 102
Configuring the DNS client······································································································· 102
Configuring static domain name resolution············································································ 102
Configuring dynamic domain name resolution········································································ 103
Configuring the DNS proxy······································································································· 104
Configuring DNS spoofing········································································································ 104
Specifying the source interface for DNS packets··········································································· 105
Configuring the DNS trusted interface ························································································ 105
Setting the DSCP value for outgoing DNS packets········································································ 106
Display and maintenance commands for DNS·············································································· 106
IPv4 DNS configuration examples ····························································································· 106
Example: Configuring static domain name resolution ······························································ 106
Example: Configuring dynamic domain name resolution ·························································· 107
Example: Configuring DNS proxy························································································ 109
IPv6 DNS configuration examples ····························································································· 111
Example: Configuring static domain name resolution ······························································ 111
Example: Configuring dynamic domain name resolution ·························································· 111
Example: Configuring DNS proxy························································································ 114
Troubleshooting DNS configuration···························································································· 115
Failure to resolve IPv4 addresses ······················································································· 115
Failure to resolve IPv6 addresses ······················································································· 116
Configuring IP forwarding basic settings············································ 117
About FIB table ····················································································································· 117
Saving the IP forwarding entries to a file ····················································································· 117

v
Display and maintenance commands for FIB table········································································ 118
Configuring IRDP········································································· 119
About IRDP ·························································································································· 119
IRDP operation··············································································································· 119
Protocols and standards ··································································································· 119
IRDP tasks at a glance············································································································ 119
Restrictions and guidelines: IRDP configuration············································································ 119
Enabling IRDP ······················································································································ 120
Specifying the preference of advertised IP addresses···································································· 120
Setting the lifetime of advertised IP addresses ············································································· 120
Setting the advertising intervals································································································· 121
Specifying the multicast address as the destination address for RAs················································· 121
Specifying a proxy-advertised IP address···················································································· 122
IRDP configuration examples ··································································································· 122
Example: Configuring IRDP······························································································· 122
Optimizing IP performance····························································· 125
IP performance optimization tasks at a glance·············································································· 125
Enabling an interface to forward directed broadcasts destined for the directly connected network ··········· 125
About forwarding broadcasts destined for the directly connected network···································· 125
Procedure······················································································································ 126
Example: Enabling an interface to forward directed broadcasts destined for the directly connected network
··································································································································· 126
Setting the MTU of IPv4 packets sent over an interface·································································· 127
Enabling sending ICMP error messages ····················································································· 127
About sending ICMP error messages··················································································· 127
Enabling sending ICMP redirect messages··········································································· 127
Enabling sending ICMP time exceeded messages·································································· 128
Enable sending ICMP destination unreachable messages························································ 128
Configuring rate limit for ICMP error messages············································································· 129
Disabling forwarding ICMP fragments························································································· 130
Specifying the source address for ICMP packets ·········································································· 130
Setting TCP MSS for an interface······························································································ 130
Configuring TCP path MTU discovery························································································· 131
Enabling SYN Cookie ············································································································· 132
Setting the TCP buffer size ······································································································ 132
Setting TCP timers················································································································· 132
Display and maintenance commands for IP performance optimization··············································· 133
Configuring UDP helper································································· 134
About UDP helper·················································································································· 134
Configuring UDP helper to convert broadcast to unicast································································· 134
Configuring UDP helper to convert broadcast to multicast······························································· 135
Display and maintenance commands for UDP helper····································································· 135
UDP helper configuration examples··························································································· 136
Example: Configuring UDP helper to convert broadcast to unicast ············································· 136
Example: Configuring UDP helper to convert broadcast to multicast··········································· 137
Configuring basic IPv6 settings ······················································· 139
About IPv6 ··························································································································· 139
IPv6 features·················································································································· 139
IPv6 addresses··············································································································· 140
IPv6 path MTU discovery·································································································· 142
IPv6 transition technologies······························································································· 143
Protocols and standards ··································································································· 143
IPv6 basics tasks at a glance···································································································· 143
Configuring an IPv6 global unicast address ················································································· 144
About IPv6 global unicast address ······················································································ 144
Generating an EUI-64 IPv6 address ···················································································· 144
Manually assigning an IPv6 global unicast address································································· 145
Stateless address autoconfiguration···················································································· 145

vi
Configuring prefix-specific address autoconfiguration······························································ 146
Configuring an IPv6 link-local address························································································ 147
About IPv6 link-local address····························································································· 147
Restrictions and guidelines································································································ 147
Configuring automatic generation of an IPv6 link-local address for an interface····························· 147
Manually assigning an IPv6 link-local address to an interface ··················································· 147
Configuring an IPv6 anycast address ························································································· 148
Configuring path MTU discovery ······························································································· 148
Setting the interface MTU·································································································· 148
Setting a static path MTU for an IPv6 address ······································································· 148
Setting the aging time for dynamic path MTUs······································································· 149
Controlling sending ICMPv6 messages······················································································· 149
Configuring the rate limit for ICMPv6 error messages······························································ 149
Enabling replying to multicast echo requests········································································· 150
Enabling sending ICMPv6 destination unreachable messages·················································· 150
Enabling sending ICMPv6 time exceeded messages ······························································ 150
Enabling sending ICMPv6 redirect messages········································································ 151
Specifying the source address for ICMPv6 packets································································· 151
Enabling IPv6 local fragment reassembly···················································································· 152
Display and maintenance commands for IPv6 basics····································································· 152
Basic IPv6 settings configuration examples ················································································· 153
Example: Configuring basic IPv6 settings ············································································· 153
Configuring IPv6 neighbor discovery ················································ 158
About IPv6 neighbor discovery·································································································· 158
ICMPv6 messages used by IPv6 neighbor discovery ······························································ 158
Address resolution··········································································································· 158
Neighbor reachability detection ·························································································· 159
Duplicate address detection······························································································· 159
Router/prefix discovery and stateless address autoconfiguration ··············································· 160
Redirection ···················································································································· 160
Protocols and standards ··································································································· 160
IPv6 neighbor discovery tasks at a glance··················································································· 160
Configuring a static neighbor entry····························································································· 161
Setting the dynamic neighbor learning limit on an interface ····························································· 161
Setting the aging timer for ND entries in stale state ······································································· 162
Minimizing link-local ND entries································································································· 162
Setting the hop limit················································································································ 162
Configuring RA message sending and parameters········································································ 163
About RA message parameters·························································································· 163
Restrictions and guidelines································································································ 163
Enabling the sending of RA messages················································································· 164
Configuring parameters for RA messages············································································· 164
Setting the maximum number of attempts to send an NS message for DAD ······································· 165
Configuring ND snooping········································································································· 165
About ND snooping·········································································································· 165
Procedure······················································································································ 167
Enabling ND proxy ················································································································· 168
About ND proxy ·············································································································· 168
Enabling common ND proxy ······························································································ 169
Enabling local ND proxy···································································································· 169
Display and maintenance commands for IPv6 ND········································································· 169
ND Snooping configuration examples························································································· 170
Example: Configuring ND snooping····················································································· 170
DHCPv6 overview········································································ 173
DHCPv6 address/prefix assignment··························································································· 173
Rapid assignment involving two messages ··········································································· 173
Assignment involving four messages··················································································· 173
Address/prefix lease renewal···································································································· 174
Stateless DHCPv6 ················································································································· 175
DHCPv6 options···················································································································· 175

vii
Option 18······················································································································· 175
Option 37······················································································································· 176
Protocols and standards·········································································································· 177
Configuring the DHCPv6 server ······················································ 178
About DHCPv6 server············································································································· 178
IPv6 address assignment·································································································· 178
IPv6 prefix assignment ····································································································· 178
Concepts······················································································································· 179
DHCPv6 address pool······································································································ 179
IPv6 address/prefix allocation sequence··············································································· 180
DHCPv6 server tasks at a glance······························································································ 181
Configuring IPv6 prefix assignment···························································································· 181
Configuring IPv6 address assignment ························································································ 183
Configuring network parameters assignment ··············································································· 184
About network parameters assignment ················································································ 184
Configuring network parameters in a DHCPv6 address pool····················································· 184
Configuring network parameters in a DHCPv6 option group ····················································· 185
Configuring the DHCPv6 server on an interface············································································ 186
Configuring a DHCPv6 policy for IPv6 address and prefix assignment··············································· 187
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 server·········································· 188
Configuring DHCPv6 binding auto backup··················································································· 188
Enabling the DHCPv6 server to advertise IPv6 prefixes·································································· 189
Enabling DHCPv6 logging on the DHCPv6 server········································································· 189
Display and maintenance commands for DHCPv6 server ······························································· 190
DHCPv6 server configuration examples······················································································ 191
Example: Configuring dynamic IPv6 prefix assignment···························································· 191
Example: Configuring dynamic IPv6 address assignment························································· 193
Configuring the DHCPv6 relay agent················································ 196
About DHCPv6 relay agent ······································································································ 196
Typical application··········································································································· 196
DHCPv6 relay agent operating process················································································ 196
DHCPv6 relay agent tasks at a glance························································································ 197
Enabling the DHCPv6 relay agent on an interface········································································· 197
Specifying DHCPv6 servers on the relay agent ············································································ 198
Specifying DHCPv6 server IP addresses·············································································· 198
Specifying DHCPv6 servers for a DHCPv6 address pool on the DHCPv6 relay agent ···················· 198
Specifying a gateway address for DHCPv6 clients ········································································ 199
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 relay agent ··································· 199
Specifying a padding mode for the Interface-ID option ··································································· 200
Enabling the DHCPv6 relay agent to advertise IPv6 prefixes··························································· 200
Configuring DHCPv6 relay security features ················································································ 200
Enabling the DHCPv6 relay agent to record relay entries ························································· 200
Enabling IPv6 release notification ······················································································· 201
Enabling client offline detection ·························································································· 201
Display and maintenance commands for DHCPv6 relay agent························································· 202
DHCPv6 relay agent configuration examples ··············································································· 202
Example: Configuring DHCPv6 relay agent··········································································· 202
Configuring the DHCPv6 client························································ 205
About the DHCPv6 client········································································································· 205
Restrictions and guidelines: DHCPv6 client configuration ······························································· 205
DHCPv6 client tasks at a glance ······························································································· 205
Configuring the DHCPv6 client DUID ························································································· 205
Configuring IPv6 address acquisition·························································································· 206
Configuring IPv6 prefix acquisition····························································································· 206
Configuring IPv6 address and prefix acquisition············································································ 206
Configuring acquisition of configuration parameters except IP addresses and prefixes·························· 207
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 client ··········································· 207
Display and maintenance commands for DHCPv6 client································································· 208
DHCPv6 client configuration examples······················································································· 208

viii
Example: Configuring IPv6 address acquisition······································································ 208
Example: Configuring IPv6 prefix acquisition········································································· 210
Example: Configuring IPv6 address and prefix acquisition························································ 211
Example: Configuring stateless DHCPv6·············································································· 213
Configuring DHCPv6 snooping························································ 216
About DHCPv6 snooping········································································································· 216
Application of trusted and untrusted ports············································································· 216
Restrictions and guidelines: DHCPv6 snooping configuration ·························································· 217
DHCPv6 snooping tasks at a glance ·························································································· 217
Configuring basic DHCPv6 snooping·························································································· 217
Configuring DHCP snooping support for Option 18········································································ 218
Configuring DHCP snooping support for Option 37········································································ 218
Configuring DHCPv6 snooping entry auto backup········································································· 218
Setting the maximum number of DHCPv6 snooping entries····························································· 219
Configuring DHCPv6 packet rate limit························································································· 219
Enabling DHCPv6-REQUEST check·························································································· 220
Configuring a DHCPv6 packet blocking port ················································································ 220
Enabling DHCPv6 snooping logging··························································································· 221
Display and maintenance commands for DHCPv6 snooping ··························································· 221
DHCPv6 snooping configuration examples·················································································· 222
Example: Configuring DHCPv6 snooping·············································································· 222
Document conventions and icons ···················································· 223
Conventions ························································································································· 223
Network topology icons ··········································································································· 224
Support and other resources ·························································· 225
Accessing Hewlett Packard Enterprise Support ············································································ 225
Accessing updates················································································································· 225
Websites ······················································································································· 225
Customer self repair········································································································· 226
Remote support ·············································································································· 226
Documentation feedback ·································································································· 226
Index························································································· 227

1
Configuring ARP
About ARP
ARP resolves IP addresses into MAC addresses on Ethernet networks.
ARP message format
ARP uses two types of messages: ARP request and ARP reply. Figure 1 shows the format of ARP
request/reply messages. Numbers in the figure refer to field lengths.
Figure 1 ARP message format
•Hardware type—Hardware address type. The value 1 represents Ethernet.
•Protocol type—Type of the protocol address to be mapped. The hexadecimal value 0x0800
represents IP.
•Hardware address length and protocol address length—Length, in bytes, of a hardware
address and a protocol address. For an Ethernet address, the value of the hardware address
length field is 6. For an IPv4 address, the value of the protocol address length field is 4.
•OP—Operation code, which describes the type of ARP message. The value 1 represents an
ARP request, and the value 2 represents an ARP reply.
•Sender hardware address—Hardware address of the device sending the message.
•Sender protocol address—Protocol address of the device sending the message.
•Target hardware address—Hardware address of the device to which the message is being
sent.
•Target protocol address—Protocol address of the device to which the message is being sent.
ARP operating mechanism
As shown in Figure 2, Host Aand Host B are on the same subnet. Host Asends a packet to Host B as
follows:
1. Host A looks through the ARP table for an ARP entry for Host B. If one entry is found, Host A
uses the MAC address in the entry to encapsulate the IP packet into a data link layer frame.
Then Host A sends the frame to Host B.
2. If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request.
The payload of the ARP request contains the following information:
{Sender IP address and sender MAC address—HostA's IP address and MAC address.
{Target IP address—Host B's IP address.
{Target MAC address—An all-zero MAC address.

2
All hosts on this subnet can receive the broadcast request, but only the requested host (Host B)
processes the request.
3. Host B compares its own IP address with the target IP address in the ARP request. If they are
the same, Host B operates as follows:
a. Adds the sender IP address and sender MAC address into its ARP table.
b. Encapsulates its MAC address into an ARP reply.
c. Unicasts the ARP reply to Host A.
4. After receiving the ARP reply, Host A operates as follows:
a. Adds the MAC address of Host B into its ARP table.
b. Encapsulates the MAC address into the packet and sends the packet to Host B.
Figure 2 ARP address resolution process
If Host A and Host B are on different subnets, HostA sends a packet to Host B as follows:
1. Host A broadcasts an ARP request where the target IP address is the IP address of the
gateway.
2. The gateway responds with its MAC address in an ARP reply to Host A.
3. Host A uses the gateway's MAC address to encapsulate the packet, and then sends the packet
to the gateway.
4. If the gateway has an ARP entry for Host B, it forwards the packet to Host B directly. If not, the
gateway broadcasts an ARP request, in which the target IP address is the IP address of Host B.
5. After the gateway gets the MAC address of Host B, it sends the packet to Host B.
ARP entry types
An ARP table stores dynamic ARPentries, OpenFlow ARP entries, Rule ARPentries, and static ARP
entries.
Dynamic ARP entry
ARP automatically creates and updates dynamic entries. A dynamic ARP entry is removed when its
aging timer expires or the output interface goes down. In addition, a dynamic ARP entry can be
overwritten by a static ARP entry.
Static ARP entry
A static ARP entry is manually configured and maintained. It does not age out and cannot be
overwritten by any dynamic ARP entry.
Static ARP entries protect communication between devices because attack packets cannot modify
the IP-to-MAC mapping in a staticARP entry.
The device supports the following types of staticARP entries:

3
•Long static ARP entry—It is directly used for forwarding packets. A long static ARP entry
contains the IP address, MAC address, VLAN, and output interface.
•Short static ARP entry—It contains only the IP address and MAC address.
If the output interface is a VLAN interface, the device sends an ARP request whose target IP
address is the IP address in the short entry. If the sender IP and MAC addresses in the received
ARP reply match the short static ARP entry, the device performs the following operations:
{Adds the interface that received theARP reply to the short static ARP entry.
{Uses the resolved short staticARP entry to forward IP packets.
•Multiport ARP entry—It contains the IP address, MAC address, and VLAN.
The device can use a multiport ARP entry that has the same MAC address and VLAN as a
multicast or multiport unicast MAC address entry for packet forwarding. A multiport ARP entry is
manually configured. It does not age out and cannot be overwritten by any dynamic ARP entry.
For more information about multicast MAC, see the IGMP snooping configuration in IP Multicast
Configuration Guide.
To communicate with a host by using a fixed IP-to-MAC mapping, configure a short staticARP entry
on the device. To communicate with a host by using a fixed IP-to-MAC mapping through an interface
in a VLAN, configure a long staticARP entry on the device.
OpenFlow ARP entry
ARP creates OpenFlow ARP entries by learning from the OpenFlow module. An OpenFlow ARP
entry does not age out, and it cannot be updated. An OpenFlow ARP entry can be used directly to
forward packets. For more information about OpenFlow, see OpenFlow Configuration Guide.
Rule ARP entry
Rule ARPentries can be directly used for packet forwarding.ARule ARP entry does not age out, and
it cannot be updated. It can be overwritten by a static ARP entry.
ARP creates Rule ARP entries by learning from the portal authentication module. For more
information about portal authentication, see portal authentication configuration in Security
Configuration Guide.
ARP tasks at a glance
All ARP tasks are optional.
•Configuring a staticARP entry
{Configuring a short static ARP entry
{Configuring a long staticARP entry
{Configuring a multiportARP entry
•Configuring features for dynamicARP entries
{Setting the dynamic ARP learning limit for a device
{Setting the dynamic ARP learning limit for an interface
{Setting the aging timer for dynamic ARP entries
{Enabling dynamic ARP entry check
•Enabling ARP logging
Configuring a static ARP entry
Static ARP entries are effective when the device functions correctly.

4
Configuring a short static ARP entry
Restrictions and guidelines
A resolved short static ARP entry becomes unresolved upon certain events, for example, when the
resolved output interface goes down, or the corresponding VLAN or VLAN interface is deleted.
Procedure
1. Enter system view.
system-view
2. Configure a short static ARP entry.
arp static ip-address mac-address
Configuring a long static ARP entry
About long static ARP entries
Long static ARP entries can be effective or ineffective. Ineffective long static ARP entries cannot be
used for packet forwarding. Along static ARPentry is ineffective when any of the followingconditions
exists:
•The corresponding VLAN interface or output interface is down.
•The IP address in the entry conflicts with a local IP address.
•No local interface has an IP address in the same subnet as the IP address in the ARP entry.
A long static ARP entry in a VLAN is deleted if the VLAN or VLAN interface is deleted.
Procedure
1. Enter system view.
system-view
2. Configure a long static ARP entry.
arp static ip-address mac-address [vlan-id interface-type
interface-number ]
Configuring a multiport ARP entry
About multiport ARP entries
A multiport ARP entry contains an IP address, MAC address, and VLAN ID. The VLAN and output
interfaces are specified by a multiport unicast MAC address entry or a multicast MAC address entry.
A multiport ARP entry can overwrite a dynamic, short static or long static ARP entry. Conversely, a
short static or long staticARP entry can overwrite a multiportARP entry.
Restrictions and guidelines
For a multiport ARP entry to be effective for packet forwarding, make sure the following conditions
are met:
•A multiport unicast MAC address entry or a multicast MAC address entry exists.
•The IP address in the multiport ARP entry must reside on the same subnet as the VLAN
interface of the specified VLAN.
Procedure
1. Enter system view.
system-view

5
2. Configure a multiport unicast MAC address entry or a multicast MAC address entry.
{Configure a multiport unicast MAC address entry.
mac-address multiport mac-address interface interface-list vlan
vlan-id
For more information about multiport unicast MAC address entries, see the mac-address
command in Layer 2—LAN Switching Command Reference.
{Configure a multicast MAC address entry.
mac-address multicast mac-address interface interface-list vlan
vlan-id
For more information about multicast MAC address entries, see the mac-address
multicast command in IGMP snooping commands in IP Multicast Command Reference.
3. Configure a multiport ARP entry.
arp multiport ip-address mac-address vlan-id
The specified MAC address and VLAN ID must be the same as those in the multiport unicast
MAC address entry or the multicast MAC address entry.
Configuring features for dynamic ARP entries
Setting the dynamic ARP learning limit for a device
About the dynamic ARP learning limit for a device
Adevice can dynamically learn ARPentries. To prevent a device from holding too many ARPentries,
you can set the maximum number of dynamic ARP entries that the device can learn. When the limit
is reached, the device stopsARP learning.
If you set a value lower than the number of existing dynamic ARPentries, the device does not delete
the existing entries unless they age out.
Procedure
1. Enter system view.
system-view
2. Set the dynamic ARP learning limit for the device.
arp max-learning-number max-number slot slot-number
By default, the device can learn a maximum of 1024 dynamic ARP entries.
To disable the device from dynamic ARP learning, set the value to 0.
Setting the dynamic ARP learning limit for an interface
About setting the dynamic ARP learning limit for an interface
An interface can dynamically learnARP entries. To prevent an interface from holding too many ARP
entries, you can set the maximum number of dynamic ARPentries that the interface can learn. When
the limit is reached, the interface stopsARP learning.
You can set limits for both a Layer 2 interface and the VLAN interface for a permitted VLAN on the
Layer 2 interface. The Layer 2 interface learns anARP entry only when neither limit is reached.
The total dynamic ARP learning limit for all interfaces will not be higher than the dynamic ARP
learning limit for the device.

6
Procedure
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Set the dynamic ARP learning limit for the interface.
arp max-learning-num max-number
By default, an interface can learn a maximum of 1024 dynamic ARP entries.
To disable the interface from dynamic ARP learning, set the value to 0.
Setting the aging timer for dynamic ARP entries
About the aging timer for dynamic ARP entries
Each dynamic ARP entry in the ARP table has a limited lifetime, called an aging timer. The aging
timer of a dynamic ARP entry is reset each time the dynamic ARP entry is updated. Adynamic ARP
entry that is not updated before its aging timer expires is deleted from the ARP table.
Procedure
1. Enter system view.
system-view
2. Set the aging timer for dynamic ARP entries.
arp timer aging {aging-minutes |second aging-seconds }
The default setting is 20 minutes.
Enabling dynamic ARP entry check
About dynamic ARP entry check
The dynamic ARPentry check feature disables the device from supporting dynamic ARPentries that
contain multicast MAC addresses. The device cannot learn dynamic ARP entries containing
multicast MAC addresses. You cannot manually add static ARP entries containing multicast MAC
addresses.
When dynamic ARP entry check is disabled, ARP entries containing multicast MAC addresses are
supported. The device can learn dynamic ARPentries containing multicast MAC addresses obtained
from the ARP packets sourced from a unicast MAC address. You can also manually add static ARP
entries containing multicast MAC addresses.
Procedure
1. Enter system view.
system-view
2. Enable dynamic ARP entry check.
arp check enable
By default, dynamic ARP entry check is enabled.

7
Enabling ARP logging
About ARP logging
This feature enables a device to log ARP events when ARP cannot resolve IP addresses correctly.
The log information helps administrators locate and solve problems. The devicecan log the following
ARP events:
•On a proxy ARP-disabled interface, the target IP address of a received ARPpacket is not the IP
address of the receiving interface.
•The sender IP address of a received ARP reply conflicts with the IP address of the receiving
interface.
The device sends ARP log messages to the information center. You can use the info-center
source command to specify the log output rules for the information center. For more information
about information center, see Network Management and Monitoring Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Enable ARP logging.
arp check log enable
By default, ARP logging is disabled.
Display and maintenance commands for ARP
IMPORTANT:
Clearing ARP entries from the ARP tablemight cause communication failures. Make sure the entries
to be cleared do not affect current communications.
Execute display commands in any view and reset commands in user view.
Task Command
Display ARP entries.
display arp [[all |dynamic |multiport |
static ][slot slot-number ]|vlan vlan-
i
d
|interface interface-type
interface-number ][count |verbose ]
Display the maximum number of ARP
entries that a device supports. display arp entry-limit
Display the ARP entry for an IP address. display arp ip-address [slot slot-number ]
[verbose ]
Display the aging timer of dynamic ARP
entries. display arp timer aging
Clear ARP entries from the ARP table. reset arp {all |dynamic |interface
interface-type interface-number |
multiport |slot slot-number |static }

8
ARP configuration examples
Example: Configuring a long static ARP entry
Network configuration
As shown in Figure 3, hosts are connected to Device B. Device B is connected to Device Athrough
interface GigabitEthernet 1/0/1 in VLAN 10.
To ensure secure communications between Device A and Device B, configure a long static ARP
entry for Device A on Device B.
Figure 3 Network diagram
Procedure
# Create VLAN 10.
<DeviceB> system-view
[DeviceB] vlan 10
[DeviceB-vlan10] quit
# Add interface GigabitEthernet 1/0/1 to VLAN 10.
[DeviceB] interface gigabitethernet 1/0/1
[DeviceB-GigabitEthernet1/0/1] port access vlan 10
[DeviceB-GigabitEthernet1/0/1] quit
# Create VLAN-interface 10 and configure its IP address.
[DeviceB] interface vlan-interface 10
[DeviceB-vlan-interface10] ip address 192.168.1.2 8
[DeviceB-vlan-interface10] quit
# Configure a long staticARP entry that has IP address 192.168.1.1, MAC address 00e0-fc01-0000,
and output interface GigabitEthernet 1/0/1 in VLAN 10.
[DeviceB] arp static 192.168.1.1 00e0-fc01-0000 10 gigabitethernet 1/0/1
Verifying the configuration
# Verify that Device B has a long static ARP entry for Device A.
[DeviceB] display arp static
Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid
IP address MAC address VID Interface/Link ID Aging Type
Device A
GE1/0/1
VLAN10
192.168.1.1/24
00e0-fc01-0000
Device B

9
192.168.1.1 00e0-fc01-0000 10 GE1/0/1 N/A S
Example: Configuring a short static ARP entry
Network configuration
As shown in Figure 4, hosts are connected to Device B. Device B is connected to Device Athrough
interface GigabitEthernet 1/0/2.
To ensure secure communications between Device A and Device B, configure a short static ARP
entry for Device A on Device B.
Figure 4 Network diagram
Procedure
# Configure an IP address for GigabitEthernet 1/0/2.
<DeviceB> system-view
[DeviceB] interface gigabitethernet 1/0/2
[DeviceB-GigabitEthernet1/0/2] ip address 192.168.1.2 24
[DeviceB-GigabitEthernet1/0/2] quit
# Configure a short static ARP entry that has IP address 192.168.1.1 and MAC address
00e0-fc01-001f.
[DeviceB] arp static 192.168.1.1 00e0-fc01-001f
Verifying the configuration
# Verify that Device B has a short static ARP entry for Device A
[DeviceB] display arp static
Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid
IP address MAC address VID Interface/Link ID Aging Type
192.168.1.1 00e0-fc01-001f N/A N/A N/A S
Example: Configuring a multiport ARP entry
Network configuration
As shown in Figure 5, a device connects to three servers through interfaces GigabitEthernet 1/0/1,
GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 in VLAN 10. The servers share the IP address
192.168.1.1/24 and MAC address 00e0-fc01-0000.

10
Configure a multiportARP entry so that the device sends IP packets with the destination IP address
192.168.1.1 to the three servers.
Figure 5 Network diagram
Procedure
# Create VLAN 10.
<Device> system-view
[Device] vlan 10
[Device-vlan10] quit
# Add GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 to VLAN 10.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] port access vlan 10
[Device-GigabitEthernet1/0/1] quit
[Device] interface gigabitethernet 1/0/2
[Device-GigabitEthernet1/0/2] port access vlan 10
[Device-GigabitEthernet1/0/2] quit
[Device] interface gigabitethernet 1/0/3
[Device-GigabitEthernet1/0/3] port access vlan 10
[Device-GigabitEthernet1/0/3] quit
# Create VLAN-interface 10 and specify its IP address.
[Device] interface vlan-interface 10
[Device-vlan-interface10] ip address 192.168.1.2 24
[Device-vlan-interface10] quit
# Configure a multiport unicast MAC address entry that has MAC address 00e0-fc01-0000, and
output interfaces GigabitEthernet 1/0/1, GigabitEthernet 1/0/2, and GigabitEthernet 1/0/3 in VLAN
10.
[Device] mac-address multiport 00e0-fc01-0000 interface gigabitethernet 1/0/1 to
gigabitethernet 1/0/3 vlan 10
# Configure a multiportARP entry with IP address 192.168.1.1 and MAC address 00e0-fc01-0000.
[Device] arp multiport 192.168.1.1 00e0-fc01-0000 10
Verifying the configuration
# Verify that the device has a multiport ARP entry with IP address 192.168.1.1 and MAC address
00e0-fc01-0000.
[Device] display arp
Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid