28[SwitchA-GigabitEthernet1/0/2] quitAdd local access user test.[SwitchA] local-user test[SwitchA-luser-test] service-type lan-access[SwitchA-luser-test] password simple test[SwitchA-luser-test] quitEnable ARP detection for VLAN 10.[SwitchA] vlan 10[SwitchA-vlan10] arp detection enableConfigure the upstream port as a trusted port and the downstream ports as untrusted ports (a port is anuntrusted port by default).[SwitchA-vlan10] interface GigabitEthernet 1/0/3[SwitchA-GigabitEthernet1/0/3] arp detection trust[SwitchA-GigabitEthernet1/0/3] quitEnable ARP detection based on 802.1X security entries.[SwitchA] arp detection mode dot1xAfter the preceding configurations, when ARP packets arrive at interfaces GigabitEthernet 1/0/1 andGigabitEthernet 1/0/2, they are checked against 802.1X security entries.Configuring periodic sending of gratuitous ARPpacketsIntroductionIf an attacker sends spoofed gratuitous ARP packets to hosts on a network, traffic that the hosts want tosend to the gateway is sent to the attacker instead. As a result, the hosts cannot access external networks.To prevent such gateway spoofing attacks, you can enable the gateway to send gratuitous ARP packetscontaining its primary IP address or one of its manually configured secondary IP addresses at a specificinterval. In this way, each host can learn correct gateway address information.Configuration procedureTo configure the gateway to send ARP packets periodically:To do… Use the command… Remarks1. Enter system view system-view —2. Enter interface view interface interface-type interface-number —3. Enable periodic sending ofgratuitous ARP packets and set thesending intervalarp anti-attack send-gratuitous-arp [ intervalmilliseconds ]RequiredDisabled by default.
