北电5510和8600交换机防止arp欺骗的官方解决方案

In release BOSS 4.2 for the ERS5510, you can enable ARP Spoofing Detection via the WEB
interface or by using a CLI command as shown below.
CLI
• 5510-48T(config)#interface fastEthernet <ALL|port|slot/port>
• 5510-48T(config)#qos arp spoofing [port <port_list>] enable default-gateway <a.b.c.d>
where
Parameter Description
port <port_list> The list of ports to enable QoS ARP spoofing application
on.
default-gateway <A.B.C.D> The IP address of the default gateway to use.

在支持三层交换的版本里面，命令有所更新，在需要防止欺骗的vlan里面做，建议每个vlan都做


ES 8600 with R-Modules:
Assuming:
• The default gateway is 10.1.25.1
• The user ports are ports 4/25-4/27
NOTE: The items high-lighted in red in the configuration file below is the default gateway address
#
# R-MODULE FILTER CONFIGURATION
#
filter act 1 create
filter act 1 ethernet dstMac
filter act 1 arp operation
filter act 1 pattern p1 add ether-begin 224 32
filter act 1 pattern p2 add ether-begin 304 32
filter act 1 apply
filter acl 1 create inPort act 1
filter acl 1 port add 4/25-4/27
filter acl 1 ace 1 create
filter acl 1 ace 1 action permit
filter acl 1 ace 1 debug count enable
filter acl 1 ace 1 ethernet dst-mac eq ff:ff:ff:ff:ff:ff
filter acl 1 ace 1 arp operation eq arprequest
filter acl 1 ace 1 enable
filter acl 1 ace 2 create
filter acl 1 ace 2 action deny
filter acl 1 ace 2 debug count enable
filter acl 1 ace 2 arp operation eq arprequest
filter acl 1 ace 2 enable
filter acl 1 ace 3 create
filter acl 1 ace 3 action deny
filter acl 1 ace 3 debug count enable
filter acl 1 ace 3 advanced custom-filter1 p1 eq a011901
filter acl 1 ace 3 enable
filter acl 1 ace 4 create
filter acl 1 ace 4 action deny
filter acl 1 ace 4 debug count enable
filter acl 1 ace 4 advanced custom-filter2 p2 eq a011901
filter acl 1 ace 4 enable
filter acl 1 ace 5 create
filter acl 1 ace 5 action permit
filter acl 1 ace 5 debug count enable
filter acl 1 ace 5 arp operation eq arpresponse
filter acl 1 ace 5 enable
#
# R-MODULE FILTER CONFIGURATION
#
filter act 1 create
filter act 1 arp operation
filter act 1 pattern p1 add ether-begin 224 32
filter act 1 apply
filter acl 1 create inPort act 1
filter acl 1 port add 4/25
filter acl 1 ace 1 create
filter acl 1 ace 1 action deny
filter acl 1 ace 1 debug count enable
filter acl 1 ace 1 advanced custom-filter1 p1 eq a011901
filter acl 1 ace 1 enable