H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 342)

328
Enabling ARP black hole routing
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable ARP black hole
routing.
arp resolving-route enable
Optional.
The aging time of ARP black hole
routes is 25 seconds by default.
Displaying and maintaining ARP source suppression
Task Command Remarks
Display ARP source suppression
configuration information.
display arp source-suppression [ |
{ begin | exclude | include }
regular-expression ] Available in any view
Unresolvable IP attack protection configuration example
Network requirements
As shown in Figure 140 , a LAN contains two areas: an R&D area in VLAN 10 and an office area in
VLAN 20. The two areas connect to the gateway (AC) through an access switch.
A large number of ARP requests with the same source address are detected in the office area and are
considered as an unresolvable IP attack. To defend against the attack, configure ARP source suppression
and ARP black hole routing.
Figure 140 Network diagram
IP network
Gateway
AC
R&D Office
VLAN 10 VLAN 20
Client 1 Client 2 Client 3 Client 4
ARP attack protection
AP 1 AP 2