Configuring Interface-based ARP Entry Limiting

Context

To prevent ARP entries from being exhausted by ARP attacks from a host connecting to an interface on the device, set the maximum number of ARP entries that the interface can dynamically learn. When the number of ARP entries learned by a specified interface reaches the maximum number, the interface cannot dynamically learn new ARP entries.

Perform the following steps on the gateway.

Procedure

Configuring ARP entry limiting on a Layer 2 interface
1. Run system-view
  The system view is displayed.
2. Run interface interface-type interface-number
  The interface view is displayed.
3. Run arp-limit vlan vlan-id1 [ to vlan-id2 ] maximum maximum
  ARP entry limiting on the Layer 2 interface is configured.
  
  By default, the maximum number of ARP entries that an interface can dynamically learn is the same as the number of ARP entries supported by the device.
Configuring ARP entry limiting on a Layer 3 interface or sub-interface
1. Run system-view
  The system view is displayed.
2. Run interface interface-type interface-number [.subinterface-number ]
  The interface view or sub-interface view is displayed.
3. (Optional) On an Ethernet interface, run undo portswitch
  The interface is switched to Layer 3 mode.
  
  By default, an Ethernet interface works in Layer 2 mode.
  
  Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S support switching between Layer 2 and Layer 3 modes.
4. Run arp-limit maximum maximum
  ARP entry limiting on a Layer 3 interface or sub-interface interface is configured.
  
  By default, the maximum number of ARP entries that an interface can dynamically learn is the same as the number of ARP entries supported by the device.
  
  Only the S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S support such sub-interface configurations.