1-10z Add a static ARP entry, with the IP address being 192.168.1.1, the MAC address being000f-e201-0000, and the outbound port being Ethernet1/0/10 of VLAN 1.Configuration procedure system-view[Sysname] undo arp check enable[Sysname] arp timer aging 10[Sysname] arp static 192.168.1.1 000f-e201-0000 1 Ethernet1/0/10ARP Attack Detection and Packet Rate Limit Configuration ExampleNetwork requirementsAs shown in Figure 1-4, Ethernet1/0/1 of Switch A (S3100-EI) connects to DHCP Server; Ethernet1/0/2connects to Client A, Ethernet1/0/3 connects to Client B. Ethernet1/0/1, Ethernet1/0/2 andEthernet1/0/3 belong to VLAN 1.z Enable DHCP snooping on Switch A and specify Ethernet1/0/1 as the DHCP snooping trusted port.z Enable ARP attack detection in VLAN 1 to prevent ARP man-in-the-middle attacks, and specifyEthernet1/0/1 as the ARP trusted port.z Enable the ARP packet rate limit function on Ethernet1/0/2 and Ethernet1/0/3 of Switch A, so as toprevent Client A and Client B from attacking Switch A through ARP traffic.z Enable the port state auto recovery function on the ports of Switch A, and set the recovery intervalto 200 seconds.Network diagramFigure 1-4 ARP attack detection and packet rate limit configurationConfiguration procedure# Enable DHCP snooping on Switch A. system-view[SwitchA] dhcp-snooping# Specify Ethernet1/0/1 as the DHCP snooping trusted port and the ARP trusted port.[SwitchA] interface Ethernet1/0/1[SwitchA-Ethernet1/0/1] dhcp-snooping trust
