HPE FlexNetwork 10500 SERIES User manual

HPE FlexNetwork 10500 Switch Series
Layer 3—IP Services Configuration Guide
Part number: 5200
-1900a
Software
version: 10500-CMW710-R7557P01
Document version: 6W101-20171020

© Copyright 2017 Hewlett Packard Enterprise Development LP
The information contained herein is subject to change without notice. The only warranties for Hewlett Packard
Enterprise products and services are set forth in the express warranty statements accompanying such
products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or
copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software
Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s
standard commercial license.
Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard
Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise
website.
Acknowledgments
Intel®, Itanium®, Pentium®, Intel Inside®, and the Intel Inside logo are trademarks of Intel Corporation in the
United States and other countries.
Microsoft® and Windows® are trademarks of the Microsoft group of companies.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated.
Java and Oracle are registered trademarks of Oracle and/or its affiliates.
UNIX® is a registered trademark of The Open Group.

i
Contents
Configuring ARP····························································································1
Overview····························································································································································1
ARP message format·································································································································1
ARP operating mechanism ························································································································1
ARP table···················································································································································2
Configuring a static ARP entry···························································································································3
Configuring a multiport ARP entry······················································································································4
Setting the maximum number of dynamic ARP entries for a device··································································5
Setting the maximum number of dynamic ARP entries for an interface ····························································5
Setting the aging timer for dynamic ARP entries ·······························································································6
Enabling dynamic ARP entry check···················································································································6
Synchronizing ARP entries ································································································································6
Configuring a customer-side port·······················································································································6
Enabling ARP logging········································································································································7
Displaying and maintaining ARP························································································································7
Configuration examples ·····································································································································8
Long static ARP entry configuration example····························································································8
Short static ARP entry configuration example····························································································9
Multiport ARP entry configuration example······························································································10
Configuring gratuitous ARP ·········································································12
Overview··························································································································································12
Gratuitous ARP packet learning···············································································································12
Periodic sending of gratuitous ARP packets····························································································12
Configuration procedure···································································································································13
Enabling IP conflict notification ························································································································13
Configuring gratuitous ARP packet retransmission for the device MAC address change ·······························14
Configuring proxy ARP················································································15
Enabling common proxy ARP··························································································································15
Enabling local proxy ARP·································································································································15
Displaying proxy ARP ······································································································································15
Common proxy ARP configuration example····································································································16
Network requirements······························································································································16
Configuration procedure···························································································································16
Verifying the configuration························································································································17
Configuring ARP snooping···········································································18
Configuration procedure···································································································································18
Displaying and maintaining ARP snooping······································································································18
Configuring ARP fast-reply ··········································································19
Overview··························································································································································19
Configuration procedure···································································································································19
ARP fast-reply configuration example··············································································································19
Network requirements······························································································································19
Configuration procedure···························································································································20
Configuring ARP proxy forwarding·······························································21
Configuring IP addressing············································································22
Overview··························································································································································22
IP address classes···································································································································22
Special IP addresses ·······························································································································23
Subnetting and masking···························································································································23
Assigning an IP address to an interface ··········································································································23
Configuration guidelines···························································································································24

ii
Configuration procedure···························································································································24
Configuring IP unnumbered·····························································································································24
Configuration guidelines···························································································································24
Configuration prerequisites······················································································································25
Configuration procedure···························································································································25
Displaying and maintaining IP addressing·······································································································25
IP address configuration example····················································································································25
Network requirements······························································································································25
Configuration procedure···························································································································26
Verifying the configuration························································································································26
DHCP overview ···························································································28
DHCP address allocation·································································································································28
Allocation mechanisms ····························································································································28
IP address allocation process··················································································································29
IP address lease extension······················································································································29
DHCP message format····································································································································30
DHCP options ··················································································································································31
Common DHCP options···························································································································31
Custom DHCP options·····························································································································31
Protocols and standards ··································································································································33
Configuring the DHCP server ······································································34
Overview··························································································································································34
DHCP address pool ·································································································································34
IP address allocation sequence···············································································································36
DHCP server configuration task list ·················································································································36
Configuring an address pool on the DHCP server···························································································37
Configuration task list·······························································································································37
Creating a DHCP address pool················································································································37
Specifying IP address ranges for a DHCP address pool ·········································································37
Specifying gateways for DHCP clients·····································································································40
Specifying a domain name suffix for DHCP clients··················································································41
Specifying DNS servers for DHCP clients································································································41
Specifying WINS servers and NetBIOS node type for DHCP clients·······················································42
Specifying BIMS server for DHCP clients································································································42
Specifying the configuration file for DHCP client auto-configuration························································43
Specifying a server for DHCP clients·······································································································43
Configuring Option 184 parameters for DHCP clients ·············································································44
Customizing DHCP options······················································································································44
Configuring the DHCP user class whitelist·······························································································46
Enabling DHCP················································································································································46
Enabling the DHCP server on an interface······································································································47
Applying an address pool on an interface········································································································47
Configuring a DHCP policy for dynamic address assignment ·········································································47
Configuring IP address conflict detection·········································································································48
Enabling handling of Option 82························································································································49
Configuring the DHCP server security features·······························································································49
Restrictions and guidelines······················································································································49
Configuring DHCP flood attack protection ·······························································································49
Configuring DHCP starvation attack protection························································································50
Configuring DHCP server compatibility············································································································51
Configuring the DHCP server to broadcast all responses········································································51
Configure the DHCP server to ignore BOOTP requests··········································································51
Configuring the DHCP server to send BOOTP responses in RFC 1048 format······································51
Setting the DSCP value for DHCP packets sent by the DHCP server·····························································52
Configuring DHCP binding auto backup ··········································································································52
Configuring address pool usage alarming ·······································································································53
Binding gateways to DHCP server's MAC address ·························································································53
Advertising subnets assigned to clients···········································································································54
Applying a DHCP address pool to a VPN instance··························································································54
Enabling client offline detection on the DHCP server ······················································································55

iii
Enabling DHCP logging on the DHCP server··································································································55
Displaying and maintaining the DHCP server··································································································56
DHCP server configuration examples··············································································································56
Static IP address assignment configuration example··············································································56
Dynamic IP address assignment configuration example ·········································································58
DHCP user class configuration example··································································································60
DHCP user class whitelist configuration example····················································································61
Primary and secondary subnets configuration example ··········································································62
DHCP option customization configuration example·················································································64
Troubleshooting DHCP server configuration ···································································································65
Symptom··················································································································································65
Analysis····················································································································································65
Solution····················································································································································65
Configuring the DHCP relay agent·······························································67
Overview··························································································································································67
Operation ·················································································································································67
DHCP relay agent support for Option 82 ·································································································68
DHCP relay agent configuration task list ·········································································································68
Enabling DHCP················································································································································69
Enabling the DHCP relay agent on an interface ······························································································69
Specifying DHCP servers on a relay agent······································································································70
Configuring the DHCP relay agent security features ·······················································································70
Enabling the DHCP relay agent to record relay entries ···········································································70
Enabling periodic refresh of dynamic relay entries ··················································································70
Configuring DHCP flood attack protection ·······························································································71
Enabling DHCP starvation attack protection····························································································72
Configuring the DHCP relay agent to release an IP address···········································································72
Configuring Option 82······································································································································73
Setting the DSCP value for DHCP packets sent by the DHCP relay agent·····················································73
Enabling DHCP server proxy on the DHCP relay agent··················································································74
Configuring a DHCP address pool on the DHCP relay agent··········································································74
Specifying the DHCP relay agent address to be padded to DHCP requests···················································75
Enabling client offline detection on the DHCP relay agent ··············································································75
Configuring the DHCP smart relay feature·······································································································76
Specifying the DHCP server selecting algorithm ·····························································································77
Specifying the source IP address for DHCP requests ·····················································································79
Discarding DHCP requests that are delivered from VXLAN tunnels································································79
Displaying and maintaining the DHCP relay agent··························································································80
DHCP relay agent configuration examples······································································································81
DHCP relay agent configuration example································································································81
Option 82 configuration example ·············································································································82
DHCP server selection configuration example·························································································82
Troubleshooting DHCP relay agent configuration····························································································84
Symptom··················································································································································84
Analysis····················································································································································84
Solution····················································································································································84
Configuring the DHCP client········································································85
Enabling the DHCP client on an interface········································································································85
Configuring a DHCP client ID for an interface··································································································85
Enabling duplicated address detection ············································································································86
Setting the DSCP value for DHCP packets sent by the DHCP client ······························································86
Displaying and maintaining the DHCP client····································································································86
DHCP client configuration example ·················································································································87
Network requirements······························································································································87
Configuration procedure···························································································································87
Verifying the configuration························································································································88
Configuring DHCP snooping········································································90
Overview··························································································································································90
Application of trusted and untrusted ports································································································90

iv
DHCP snooping support for Option 82·····································································································91
DHCP snooping configuration task list·············································································································92
Configuring basic DHCP snooping features ····································································································92
Restrictions and guidelines······················································································································92
Configuring basic DHCP snooping features in a common network ·························································93
Configuring basic DHCP snooping features in a VXLAN network ···························································94
Disabling DHCP snooping on an interface·······························································································95
Configuring Option 82······································································································································95
Configuring DHCP snooping entry auto backup ······························································································96
Enabling DHCP starvation attack protection····································································································97
Enabling DHCP-REQUEST attack protection··································································································98
Setting the maximum number of DHCP snooping entries ···············································································98
Configuring DHCP packet rate limit ·················································································································99
Configuring a DHCP packet blocking port ·······································································································99
Enabling DHCP snooping logging····················································································································99
Displaying and maintaining DHCP snooping ·································································································100
DHCP snooping configuration examples ·······································································································100
Global basic DHCP snooping configuration example ············································································100
VLAN-specific DHCP snooping configuration example··········································································101
Option 82 configuration example ···········································································································102
Configuring the BOOTP client····································································104
BOOTP application ········································································································································104
Obtaining an IP address dynamically·············································································································104
Protocols and standards ································································································································104
Configuring an interface to use BOOTP for IP address acquisition·······························································104
Displaying and maintaining BOOTP client·····································································································105
BOOTP client configuration example·············································································································105
Network requirements····························································································································105
Configuration procedure·························································································································105
Verifying the configuration······················································································································105
Configuring DNS························································································106
Overview························································································································································106
Static domain name resolution···············································································································106
Dynamic domain name resolution··········································································································106
DNS proxy··············································································································································107
DNS configuration task list·····························································································································108
Configuring the IPv4 DNS client·····················································································································108
Configuring static domain name resolution····························································································108
Configuring dynamic domain name resolution·······················································································109
Configuring the IPv6 DNS client·····················································································································109
Configuring static domain name resolution····························································································109
Configuring dynamic domain name resolution·······················································································110
Configuring the DNS proxy ····························································································································111
Specifying the source interface for DNS packets···························································································111
Configuring the DNS trusted interface ···········································································································112
Setting the DSCP value for outgoing DNS packets ·······················································································112
Displaying and maintaining DNS····················································································································113
IPv4 DNS configuration examples ·················································································································113
Static domain name resolution configuration example···········································································113
Dynamic domain name resolution configuration example······································································114
IPv6 DNS configuration examples ·················································································································117
Static domain name resolution configuration example···········································································117
Dynamic domain name resolution configuration example······································································117
Troubleshooting IPv4 DNS configuration·······································································································120
Symptom················································································································································120
Solution··················································································································································120
Troubleshooting IPv6 DNS configuration·······································································································120
Symptom················································································································································120
Solution··················································································································································120

v
Configuring DDNS·····················································································122
Overview························································································································································122
DDNS application···································································································································122
DDNS client configuration task list·················································································································123
Configuring a DDNS policy ····························································································································123
Configuration prerequisites····················································································································124
Configuration procedure·························································································································124
Applying the DDNS policy to an interface······································································································125
Setting the DSCP value for outgoing DDNS packets·····················································································125
Displaying DDNS ···········································································································································126
DDNS configuration examples·······················································································································126
DDNS configuration example with www.3322.org ·················································································126
DDNS configuration example with PeanutHull server············································································127
Configuring IP forwarding basic settings····················································129
Overview························································································································································129
Saving the IP forwarding entries to a file········································································································129
Displaying FIB table entries ···························································································································130
Configuring fast forwarding········································································131
Overview························································································································································131
Configuring the aging time for fast forwarding entries····················································································131
Configuring fast forwarding load sharing ·······································································································131
Displaying and maintaining fast forwarding····································································································131
Using the adjacency table··········································································133
Overview························································································································································133
Displaying and maintainig the adjacency table······························································································134
Configuring IRDP·······················································································135
Overview························································································································································135
IRDP operation·······································································································································135
Basic concepts·······································································································································135
Protocols and standards ························································································································136
Configuration procedure·································································································································136
IRDP configuration example ··························································································································137
Network requirements····························································································································137
Configuration procedure·························································································································137
Verifying the configuration······················································································································138
Optimizing IP performance ········································································139
Enabling an interface to forward directed broadcasts destined for the directly connected network ··············139
Configuration procedure·························································································································139
Configuration example···························································································································139
Setting the MTU of IPv4 packets sent over an interface················································································140
Setting TCP MSS for an interface··················································································································140
Configuring TCP path MTU discovery············································································································141
Enabling SYN Cookie·····································································································································142
Setting the TCP buffer size····························································································································142
Setting TCP timers·········································································································································142
Enabling sending ICMP error messages ·······································································································143
Disabling forwarding ICMP fragments ···········································································································144
Configuring rate limit for ICMP error messages·····························································································145
Specifying the source address for ICMP packets ··························································································145
Enabling IPv4 local fragment reassembly······································································································145
Displaying and maintaining IP performance optimization ··············································································146
Configuring UDP helper·············································································148
Overview························································································································································148
Configuration restrictions and guidelines·······································································································148
Configuring UDP helper to convert broadcast to unicast···············································································148

vi
Configuring UDP helper to convert broadcast to multicast ············································································149
Displaying and maintaining UDP helper·········································································································149
UDP helper configuration examples···············································································································150
Configuring UDP helper to convert broadcast to unicast·······································································150
Configuring UDP helper to convert broadcast to multicast ····································································151
Configuring basic IPv6 settings··································································153
Overview························································································································································153
IPv6 features··········································································································································153
IPv6 addresses ······································································································································154
IPv6 ND protocol····································································································································156
IPv6 path MTU discovery·······················································································································158
IPv6 transition technologies···························································································································159
Dual stack ··············································································································································159
Tunneling ···············································································································································159
6PE ························································································································································160
Protocols and standards ································································································································160
IPv6 basics configuration task list··················································································································160
Assigning IPv6 addresses to interfaces·········································································································161
Configuring an IPv6 global unicast address···························································································161
Configuring an IPv6 link-local address···································································································164
Configuring an IPv6 anycast address ····································································································165
Configuring IPv6 ND ······································································································································165
Configuring a static neighbor entry ········································································································165
Setting the maximum number of dynamic neighbor entries···································································166
Setting the aging timer for ND entries in stale state···············································································166
Minimizing link-local ND entries·············································································································166
Setting the hop limit································································································································167
Configuring parameters for RA messages·····························································································167
Setting the maximum number of attempts to send an NS message for DAD········································169
Configuring ND snooping·······················································································································170
Enabling ND proxy·································································································································172
Configuring a customer-side port···········································································································173
Configuring path MTU discovery····················································································································174
Setting the interface MTU ······················································································································174
Setting a static path MTU for an IPv6 address·······················································································174
Setting the aging time for dynamic path MTUs······················································································174
Controlling sending ICMPv6 messages·········································································································175
Configuring the rate limit for ICMPv6 error messages···········································································175
Enabling replying to multicast echo requests·························································································175
Enabling sending ICMPv6 destination unreachable messages·····························································176
Enabling sending ICMPv6 time exceeded messages············································································176
Enabling sending ICMPv6 redirect messages ·······················································································176
Specifying the source address for ICMPv6 packets···············································································177
Enabling IPv6 local fragment reassembly······································································································177
Enabling a device to discard IPv6 packets that contain extension headers···················································178
Enabling ND proxy forwarding ·······················································································································178
Displaying and maintaining IPv6 basics·········································································································179
IPv6 configuration example····························································································································181
Network requirements····························································································································181
Configuration procedure·························································································································181
Verifying the configuration······················································································································182
Troubleshooting IPv6 basics configuration ····································································································185
Symptom················································································································································185
Solution··················································································································································185
DHCPv6 overview······················································································186
DHCPv6 address/prefix assignment··············································································································186
Rapid assignment involving two messages ···························································································186
Assignment involving four messages·····································································································186
Address/prefix lease renewal·························································································································187
Stateless DHCPv6 ·········································································································································188

vii
Protocols and standards ································································································································188
Configuring the DHCPv6 server·································································189
Overview························································································································································189
IPv6 address assignment·······················································································································189
IPv6 prefix assignment···························································································································189
Concepts················································································································································190
DHCPv6 address pool····························································································································190
IPv6 address/prefix allocation sequence································································································191
Configuration task list·····································································································································192
Configuring IPv6 prefix assignment ···············································································································192
Configuration guidelines·························································································································192
Configuration procedure·························································································································193
Configuring IPv6 address assignment ···········································································································193
Configuration guidelines·························································································································194
Configuration procedure·························································································································194
Configuring network parameters assignment ································································································195
Configuring network parameters in a DHCPv6 address pool·································································195
Configuring network parameters in a DHCPv6 option group·································································196
Configuring a DHCPv6 policy for IPv6 address and prefix assignment·························································197
Configuring the DHCPv6 server on an interface····························································································198
Configuration guidelines·························································································································198
Configuration procedure·························································································································198
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 server···················································199
Configuring DHCPv6 binding auto backup·····································································································199
Advertising subnets assigned to clients·········································································································200
Applying a DHCPv6 address pool to a VPN instance····················································································200
Enabling the DHCPv6 server to advertise IPv6 prefixes················································································201
Enabling DHCPv6 logging on the DHCPv6 server·························································································201
Displaying and maintaining the DHCPv6 server····························································································201
DHCPv6 server configuration examples········································································································202
Dynamic IPv6 prefix assignment configuration example········································································202
Dynamic IPv6 address assignment configuration example····································································205
Configuring the DHCPv6 relay agent·························································207
Overview························································································································································207
DHCPv6 relay agent configuration task list····································································································208
Enabling the DHCPv6 relay agent on an interface ························································································208
Specifying DHCPv6 servers on the relay agent·····························································································209
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 relay agent ···········································209
Specifying a padding mode for the Interface-ID option··················································································209
Configuring a DHCPv6 address pool on the DHCPv6 relay agent ································································210
Specifying a gateway address for DHCPv6 clients························································································210
Enabling the DHCPv6 relay agent to record relay entries ·············································································211
Enabling IPv6 release notification··················································································································211
Enabling client offline detection ·····················································································································212
Enabling the DHCPv6 relay agent to advertise IPv6 prefixes········································································212
Specifying the source IPv6 address for relayed DHCPv6 requests·······························································212
Displaying and maintaining the DHCPv6 relay agent ····················································································213
DHCPv6 relay agent configuration example··································································································214
Network requirements····························································································································214
Configuration procedure·························································································································214
Verifying the configuration······················································································································215
Configuring the DHCPv6 client··································································216
Overview························································································································································216
DHCPv6 client configuration task list·············································································································216
Configuring IPv6 address acquisition·············································································································216
Configuring IPv6 prefix acquisition·················································································································217
Configuring IPv6 address and prefix acquisition····························································································217
Configuring stateless DHCPv6 ······················································································································217
Configuring the DHCPv6 client DUID ············································································································218

viii
Setting the DSCP value for DHCPv6 packets sent by the DHCPv6 client·····················································218
Displaying and maintaining DHCPv6 client····································································································218
DHCPv6 client configuration examples··········································································································219
IPv6 address acquisition configuration example····················································································219
IPv6 prefix acquisition configuration example························································································220
IPv6 address and prefix acquisition configuration example···································································222
Stateless DHCPv6 configuration example·····························································································224
Configuring DHCPv6 snooping··································································226
Overview························································································································································226
Application of trusted and untrusted ports······························································································226
Implementation of Option 18 and Option 37 ··································································································227
Option 18 for DHCPv6 snooping············································································································227
DHCPv6 snooping support for Option 37·······························································································228
DHCPv6 snooping configuration task list·······································································································228
Configuring basic DHCPv6 snooping·············································································································229
Configuring Option 18 and Option 37 ············································································································229
Configuring DHCPv6 snooping entry auto backup·························································································230
Setting the maximum number of DHCPv6 snooping entries··········································································230
Configuring DHCPv6 packet rate limit············································································································231
Enabling DHCPv6-REQUEST check·············································································································231
Configuring a DHCPv6 packet blocking port··································································································232
Enabling DHCPv6 snooping logging··············································································································232
Displaying and maintaining DHCPv6 snooping······························································································232
DHCPv6 snooping configuration example ·····································································································233
Network requirements····························································································································233
Configuration procedure·························································································································233
Verifying the configuration······················································································································234
Configuring IPv6 fast forwarding································································235
Overview························································································································································235
Configuring the aging time for IPv6 fast forwarding entries ···········································································235
Configuring IPv6 fast forwarding load sharing ·······························································································235
Displaying and maintaining IPv6 fast forwarding ···························································································236
Configuring tunneling·················································································237
Overview························································································································································237
Configuring a tunnel interface························································································································237
Displaying and maintaining tunneling configuration·······················································································239
Troubleshooting tunneling configuration········································································································239
Symptom················································································································································239
Analysis··················································································································································239
Solution··················································································································································239
IPv6 over IPv4 tunneling············································································240
Overview························································································································································240
Implementation·······································································································································240
Tunnel modes ········································································································································240
IPv6 over IPv4 tunneling configuration task list ·····························································································242
Configuring an IPv6 over IPv4 manual tunnel································································································242
Configuration example···························································································································243
Configuring a 6to4 tunnel·······························································································································246
6to4 tunnel configuration example·········································································································247
6to4 relay configuration example···········································································································249
Configuring an ISATAP tunnel·······················································································································251
Configuration example···························································································································252
IPv4 over IPv4 tunneling············································································255
Overview························································································································································255
Configuring an IPv4 over IPv4 tunnel ············································································································255
Configuration example···································································································································256

ix
IPv4 over IPv6 tunneling············································································260
Overview························································································································································260
Implementation·······································································································································260
Tunnel modes ········································································································································260
Configuring an IPv4 over IPv6 manual tunnel································································································261
Configuration example···························································································································261
IPv6 over IPv6 tunneling············································································265
Overview························································································································································265
Configuring an IPv6 over IPv6 tunnel ············································································································265
Configuration example···································································································································266
Configuring GRE ·······················································································270
Overview························································································································································270
GRE encapsulation format·····················································································································270
GRE tunnel operating principle··············································································································270
GRE application scenarios·····················································································································271
Protocols and standards ························································································································273
Configuring a GRE/IPv4 tunnel······················································································································273
Configuration guidelines·························································································································273
Configuration procedure·························································································································274
Configuring a GRE/IPv6 tunnel······················································································································275
Configuration guidelines·························································································································275
Configuration procedure·························································································································275
Displaying and maintaining GRE ···················································································································276
GRE configuration examples ·························································································································277
Configuring an IPv4 over IPv4 GRE tunnel····························································································277
Configuring an IPv4 over IPv6 GRE tunnel····························································································279
Troubleshooting GRE·····································································································································282
Symptom················································································································································282
Analysis··················································································································································282
Solution··················································································································································283
Configuring HTTP redirect·········································································284
About HTTP redirect ······································································································································284
HTTP redirect tasks at a glance·····················································································································284
Specifying the HTTPS redirect listening port number····················································································284
Associating an SSL server policy with the HTTPS redirect service·······························································285
Document conventions and icons······························································286
Conventions···················································································································································286
Network topology icons··································································································································287
Support and other resources ·····································································288
Accessing Hewlett Packard Enterprise Support·····························································································288
Accessing updates·········································································································································288
Websites ················································································································································289
Customer self repair·······························································································································289
Remote support······································································································································289
Documentation feedback ·······················································································································289
Index··········································································································291

1
Configuring ARP
Overview
ARP resolves IP addresses into MAC addresses on Ethernet networks.
ARP message format
ARP uses two types of messages: ARP request and ARP reply. Figure 1 shows the format of ARP
request/reply messages. Numbers in the figure refer to field lengths.
Figure 1 ARP message format
•
Hardware type—Hardware address type. The value 1 represents Ethernet.
•
Protocol type—Type of the protocol address to be mapped. The hexadecimal value 0x0800
represents IP.
•
Hardware address length and protocol address length—Length, in bytes, of a hardware
address and a protocol address. For an Ethernet address, the value of the hardware address
length field is 6. For an IPv4 address, the value of the protocol address length field is 4.
•
OP—Operation code, which describes the type of ARP message. The value 1 represents an
ARP request, and the value 2 represents an ARP reply.
•
Sender hardware address—Hardware address of the device sending the message.
•
Sender protocol address—Protocol address of the device sending the message.
•
Target hardware address—Hardware address of the device to which the message is being
sent.
•
Target protocol address—Protocol address of the device to which the message is being sent.
ARP operating mechanism
As shown in Figure 2, Host Aand Host B are on the same subnet. Host Asends a packet to Host B as
follows:
1. Host A looks through the ARP table for an ARP entry for Host B. If one entry is found, Host A
uses the MAC address in the entry to encapsulate the IP packet into a data link layer frame.
Then Host A sends the frame to Host B.
2. If Host A finds no entry for Host B, Host A buffers the packet and broadcasts an ARP request.
The payload of the ARP request contains the following information:
Sender IP address and sender MAC address—Host A's IP address and MAC address.
Target IP address—Host B's IP address.
Target MAC address—An all-zero MAC address.
28-byte ARP request/reply
OP Sender hardware
address Sender protocol address Target hardware
address Target protocol
address
Protocol
type
22 61 442 61
Hardware address length
Protocol address length
Hardware
type

2
All hosts on this subnet can receive the broadcast request, but only the requested host (Host B)
processes the request.
3. Host B compares its own IP address with the target IP address in the ARP request. If they are
the same, Host B operates as follows:
a. Adds the sender IP address and sender MAC address into its ARP table.
b. Encapsulates its MAC address into an ARP reply.
c. Unicasts the ARP reply to Host A.
4. After receiving the ARP reply, Host A operates as follows:
a. Adds the MAC address of Host B into its ARP table.
b. Encapsulates the MAC address into the packet and sends the packet to Host B.
Figure 2 ARP address resolution process
If Host A and Host B are on different subnets, Host A sends a packet to Host B as follows:
5. Host A broadcasts an ARP request where the target IP address is the IP address of the
gateway.
6. The gateway responds with its MAC address in an ARP reply to Host A.
7. Host A uses the gateway's MAC address to encapsulate the packet, and then sends the packet
to the gateway.
8. If the gateway has an ARP entry for Host B, it forwards the packet to Host B directly. If not, the
gateway broadcasts an ARP request, in which the target IP address is the IP address of Host B.
9. After the gateway gets the MAC address of Host B, it sends the packet to Host B.
ARP table
An ARP table stores dynamic, static, OpenFlow, and Rule ARP entries.
Dynamic ARP entry
ARP automatically creates and updates dynamic entries. A dynamic ARP entry is removed when its
aging timer expires or the output interface goes down. In addition, a dynamic ARP entry can be
overwritten by a static ARP entry.
Static ARP entry
A static ARP entry is manually configured and maintained. It does not age out and cannot be
overwritten by any dynamic ARP entry.
Static ARP entries protect communication between devices because attack packets cannot modify
the IP-to-MAC mapping in a static ARP entry.
The device supports the following types of static ARP entries:
Target IP
address
192.168.1.1
Target IP
address
192.168.1.2
Host A
192.168.1.1
0002-6779-0f4c
Host B
192.168.1.2
00a0-2470-febd
Target MAC
address
0000-0000-0000
Sender MAC
address
00a0-2470-febd
Target MAC
address
0002-6779-0f4c
Sender IP
address
192.168.1.1
Sender MAC
address
0002-6779-0f4c
Sender IP
address
192.168.1.2

3
•
Long static ARP entry—It contains the IP address, MAC address, and one of the following
combinations:
VLAN and output interface.
Input and output interfaces.
A long static ARP entry is directly used for forwarding packets.
•
Short static ARP entry—It contains only the IP address and MAC address.
If the output interface is a Layer 3 Ethernet interface, the short ARP entry can be directly
used to forward packets.
If the output interface is a VLAN interface, the device sends an ARPrequest whose target IP
address is the IP address in the short entry. If the sender IP and MAC addresses in the
received ARP reply match the short static ARP entry, the device performs the following
operations:
−Adds the interface that received the ARP reply to the short static ARP entry.
−Uses the resolved short static ARP entry to forward IP packets.
•
Multiport ARP entry—It contains the IP address, MAC address, and VLAN.
The device can use a multiport ARP entry that has the same MAC address and VLAN as a
multicast or multiport unicast MAC address entry for packet forwarding. A multiport ARP entry is
manually configured. It does not age out and cannot be overwritten by any dynamic ARP entry.
For more information about multicast MAC, see IP Multicast Configuration Guide.
To communicate with a host by using a fixed IP-to-MAC mapping, configure a short static ARP entry
on the device. To communicate with a host by using a fixed IP-to-MAC mapping through an interface
in a VLAN, configure a long static ARP entry on the device.
OpenFlow ARP entry
ARP creates OpenFlow ARP entries by learning from the OpenFlow module. An OpenFlow ARP
entry does not age out, and it cannot be updated. An OpenFlow ARP entry can be used directly to
forward packets. For more information about OpenFlow, see OpenFlow Configuration Guide.
Rule ARP entry
ARP creates Rule ARP entries by learning from the portal, VXLAN, and OVSDB modules. A Rule
ARP entry does not age out, and it cannot be updated. It can be overwritten by a static ARP entry. A
Rule ARP entry can be used directly to forward packets.
For more information about portal, see Security Configuration Guide. For more information about
VXLAN and OVSDB, see VXLAN Configuration Guide.
Configuring a static ARP entry
Static ARP entries are effective when the device functions correctly.
A resolved short static ARP entry becomes unresolved upon certain events, for example, when the
resolved output interface goes down, or the corresponding VLAN or VLAN interface is deleted.
Long static ARP entries can be effective or ineffective. Ineffective long static ARP entries cannot be
used for packet forwarding. Along static ARP entry is ineffective when any of the following conditions
exists:
•
The corresponding VLAN interface or output interface is down.
•
The IP address in the entry conflicts with a local IP address.
•
No local interface has an IP address in the same subnet as the IP address in the ARP entry.
A long static ARP entry in a VLAN is deleted if the VLAN or VLAN interface is deleted.
To configure a static ARP entry:

4
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Configure a static ARP
entry.
•Configure a long static ARP entry:
arp static ip-address mac-address
[ vlan-id interface-type
interface-number | interface-type
interface-number interface-type
interface-number | vsi-interface
vsi-interface-id tunnel number vsi
vsi-name | vsi-interface
vsi-interface-id interface-type
interface-number service-instance
instance-id vsi vsi-name ]
[ vpn-instance vpn-instance-name ]
•Configure a short static ARP entry:
arp static ip-address mac-address
[ vpn-instance vpn-instance-name ]
By default, no static ARP entries
exist.
Configuring a multiport ARP entry
A multiport ARP entry contains an IP address, MAC address, and VLAN ID.
For multiport ARP entries to be effective for packet forwarding, make sure the following conditions
are met:
•
A multicast or multiport unicast MAC address entry is configured to specify multiple output
interfaces. The MAC address entry must have the same MAC address and VLAN ID as the
multiport ARP entry. In addition, the IP address in the multiport ARP entry must reside on the
same subnet as the VLAN interface of the specified VLAN.
•
Aservice loopback group is created to support the multiport ARP service. The service loopback
group has a minimum of one member port. For information about creating and configuring a
service loopback group, see Layer 2—LAN Switching Configuration Guide.
A multiport ARP entry can overwrite a dynamic, short static or long static ARP entry. Conversely, a
short static or long static ARP entry can overwrite a multiport ARP entry.
To configure a multiport ARP entry:
Step
Command
Remarks
1. Enter system view.system-view N/A
2. Configure a multicast or
multiport unicast MAC
address entry.
•Configure a multiport unicast
MAC address entry:
mac-address multiport
mac-address interface
interface-list vlan vlan-id
•Configure a multicast MAC
address entry:
mac-address multicast
mac-address interface
interface-list vlan vlan-id
By default, no multicast or
multiport unicast MAC address
entries exist.
For more information about the
mac-address multiport
command, see Layer 2—LAN
Switching Command Reference.
For more information about the
mac-address multicast
command, see IP Multicast
Command Reference.
3. Configure a multiport
ARP entry. arp multiport ip-address
mac-address vlan-id [ vpn-instance
vpn-instance-name ] By default, no multiport ARP
entries exist.

5
Setting the maximum number of dynamic ARP
entries for a device
Adevice can dynamically learn ARP entries. To prevent a device from holding too many ARP entries,
you can set the maximum number of dynamic ARP entries that the device can learn. When the
maximum number is reached, the device stops learning ARP entries.
If you set a value lower than the number of existing dynamic ARP entries, the device does not
remove the existing entries unless they are aged out. To clear dynamic ARP entries, use the reset
arp dynamic command.
To set the maximum number of dynamic ARP entries for a device:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Set the maximum
number of dynamic
ARP entries for the
device.
•In standalone mode:
arp max-learning-number
max-number slot slot-number
•In IRF mode:
arp max-learning-number
max-number chassis chassis-number
slot slot-number
By default, the maximum
number of dynamic ARP entries
that a device can learn depends
on the maximum free space of
the ARP table.
To disable the device from
learning dynamic ARP entries,
set the number to 0.
Setting the maximum number of dynamic ARP
entries for an interface
An interface can dynamically learn ARP entries. To prevent an interface from holding too many ARP
entries, you can set the maximum number of dynamic ARP entries that the interface can learn. When
the maximum number is reached, the interface stops learning ARP entries.
You can set limits for both a Layer 2 interface and the VLAN interface for a permitted VLAN on the
Layer 2 interface. The Layer 2 interface learns an ARP entry only when neither limit is reached.
The total number of dynamic ARP entries that all interfaces learn will not be larger than the maximum
number of dynamic ARP entries set for the device.
To set the maximum number of dynamic ARP entries for an interface:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Set the maximum number
of dynamic ARP entries for
the interface. arp max-learning-num
max-number
By default, the maximum number of
dynamic ARP entries that an interface
can learn depends on the maximum
free space of the ARP table.
To disable the interface from learning
dynamic ARP entries, set the number
to 0.

6
Setting the aging timer for dynamic ARP entries
Each dynamic ARP entry in the ARP table has a limited lifetime, called an aging timer. The aging
timer of a dynamic ARP entry is reset each time the dynamic ARP entry is updated. A dynamic ARP
entry that is not updated before its aging timer expires is deleted from the ARP table.
To set the aging timer for dynamic ARP entries:
Step
Command
Remarks
1. Enter system view.
system-view
N/A
2. Set the aging timer for dynamic
ARP entries. arp timer aging
{ aging-minutes |second
aging-seconds } The default setting is 20 minutes.
Enabling dynamic ARP entry check
The dynamic ARP entry check feature disables the device from supporting dynamicARPentries that
contain multicast MAC addresses. The device cannot learn dynamic ARP entries containing
multicast MAC addresses. You cannot manually add static ARP entries containing multicast MAC
addresses.
When dynamic ARP entry check is disabled, ARP entries containing multicast MAC addresses are
supported. The device can learn dynamic ARP entries containing multicast MAC addresses obtained
from the ARP packets sourced from a unicast MAC address. You can also manually add static ARP
entries containing multicast MAC addresses.
To enable dynamic ARP entry check:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Enable dynamic ARP entry
check. arp check enable By default, dynamic ARP entry check is
enabled.
Synchronizing ARP entries
This task ensures that all cards on the device have the same ARP entries.
To synchronize ARP entries across all cards in a timely manner, you can schedule the device to
automatically execute the arp smooth command. For information about scheduling a task, see
Fundamentals Configuration Guide.
To synchronize ARP entries from the active MPU to all other cards:
Task
Command
Synchronize ARP entries from the active MPU to all
other cards. arp smooth
Configuring a customer-side port
By default, the device associates an ARP entry with routing information when the device learns an
ARP entry. The ARP entry provides the next hop information for routing. To save hardware resources,

7
you can use this command to specify a port that connects a user terminal as a customer-side port.
The device will not associate the routing information with the learned ARP entries.
To configure a customer-side port:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Enter interface view. interface interface-type
interface-number N/A
3. Configure the interface as
a customer-side port. arp mode uni By default, a port operates as a
network-side port.
Enabling ARP logging
This feature enables a device to log ARP events when ARP cannot resolve IP addresses correctly.
The device can log the following ARP events:
•
On a proxy ARP-disabled interface, the target IP address of a received ARP packet is not one of
the following IP addresses:
The IP address of the receiving interface.
The virtual IP address of the VRRP group.
•
The sender IP address of a received ARP reply conflicts with one of the following IP addresses:
The IP address of the receiving interface.
The virtual IP address of the VRRP group.
The device sends ARP log messages to the information center. You can use the info-center source
command to specify the log output rules for the information center. For more information about
information center, see Network Management and Monitoring Configuration Guide.
To enable the ARP logging feature:
Step
Command
Remarks
1. Enter system view. system-view N/A
2. Enable the ARP logging
feature. arp check log enable By default, ARP logging is disabled.
Displaying and maintaining ARP
IMPORTANT:
Clearing ARP entries from the ARP table
might cause communication failures.
Make sure the entries
to be cleared do not affect current communications.
Execute display commands in any view and reset commands in user view.
Task
Command
(In standalone mode.) Display ARP
entries.
display arp [ [ all | dynamic | multiport | static ] [ slot
slot-number ] | vlan vlan-id | interface interface-type
interface-number ] [ count | verbose ]

8
Task
Command
(In IRF mode.) Display ARP entries. display arp [[all | dynamic | multiport | static ] [ chassis chassis-number slot slot-number ] | vlan vlan-id | interface
interface-type interface-number ] [ count | verbose ]
(In standalone mode.) Display the ARP
entry for an IP address. display arp ip-address [slot slot-number ] [ verbose ]
(In IRF mode.) Display the ARP entry for
an IP address. display arp ip-address [ chassis chassis-number slot
slot-number ] [ verbose ]
Display the maximum number of ARP
entries that a device supports. display arp entry-limit
Display the ARP entries for a VPN
instance. display arp vpn-instance vpn-instance-name [ count ]
(In standalone mode.) Display the number
of OpenFlow ARP entries. display arp openflow count [ slot slot-number ]
(In IRF mode.) Display the number of
OpenFlow ARP entries. display arp openflow count [ chassis chassis-number slot
slot-number ]
Display the aging timer of dynamic ARP
entries. display arp timer aging
(In standalone mode.) Clear ARP entries
from the ARP table. reset arp { all | dynamic | interface interface-type
interface-number |multiport | slot slot-number | static }
(In IRF mode.) Clear ARP entries from the
ARP table.
reset arp { all | chassis chassis-number slot slot-number |
dynamic | interface interface-type interface-number |
multiport | static }
Configuration examples
Long static ARP entry configuration example
Network requirements
As shown in Figure 3, hosts are connected to Device B. Device B is connected to Device A through
interface GigabitEthernet 1/0/1 in VLAN 10.
To ensure secure communications between Device A and Device B, configure a long static ARP
entry for Device A on Device B.

9
Figure 3 Network diagram
Configuration procedure
# Create VLAN 10.
<DeviceB> system-view
[DeviceB] vlan 10
[DeviceB-vlan10] quit
# Add interface GigabitEthernet 1/0/1 to VLAN 10.
[DeviceB] interface gigabitethernet 1/0/1
[DeviceB-GigabitEthernet1/0/1] port access vlan 10
[DeviceB-GigabitEthernet1/0/1] quit
# Create VLAN-interface 10 and configure its IP address.
[DeviceB] interface vlan-interface 10
[DeviceB-vlan-interface10] ip address 192.168.1.2 8
[DeviceB-vlan-interface10] quit
# Configure a long static ARP entry that has IP address 192.168.1.1, MAC address 00e0-fc01-0000,
and output interface GigabitEthernet 1/0/1 in VLAN 10.
[DeviceB] arp static 192.168.1.1 00e0-fc01-0000 10 gigabitethernet 1/0/1
Verifying the configuration
# Verify that Device B has a long static ARP entry for Device A.
[DeviceB] display arp static
Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid
IP address MAC address VID Interface/Link ID Aging Type
192.168.1.1 00e0-fc01-0000 10 GE1/0/1 N/A S
Short static ARP entry configuration example
Network requirements
As shown in Figure 4, hosts are connected to Device B. Device B is connected to Device A through
interface GigabitEthernet 1/0/2.
To ensure secure communications between Device A and Device B, configure a short static ARP
entry for Device A on Device B.
Device A
GE1/0/1
VLAN10
192.168.1.1/24
00e0-fc01-0000
Device B