2-8To do… Use the command… RemarksConfigure the port stateauto-recovery intervalarp protective-down recoverinterval intervalOptionalBy default, when the port stateauto-recovery function is enabled,the port state auto-recoveryinterval is 300 seconds.z You need to enable the port state auto-recovery feature before you can configure the port stateauto-recovery interval.z You are not recommended to configure the ARP packet rate limit function on the ports of a fabric oran aggregation group.ARP Attack Defense Configuration ExampleARP Attack Defense Configuration Example INetwork requirementsAs shown in Figure 2-3, GigabitEthernet 1/0/1 of Switch A connects to DHCP Server; GigabitEthernet1/0/2 connects to Client A, GigabitEthernet 1/0/3 connects to Client B. GigabitEthernet 1/0/1,GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 belong to VLAN 1.z Enable DHCP snooping on Switch A and specify GigabitEthernet 1/0/1 as the DHCP snoopingtrusted port.z Enable ARP attack detection in VLAN 1 to prevent ARP man-in-the-middle attacks, and specifyGigabitEthernet 1/0/1 as the ARP trusted port.z Enable the ARP packet rate limit function on GigabitEthernet 1/0/2 and GigabitEthernet 1/0/3 ofSwitch A, so as to prevent Client A and Client B from attacking Switch A through ARP traffic.z Enable the port state auto recovery function on the ports of Switch A, and set the recovery intervalto 200 seconds.
