< Home

Configuring Static ARP

Context

Static ARP entries cannot be aged or overwritten by dynamic ARP entries and therefore they enhance communication security.

Static ARP entries prevent malicious modification. They are suitable for small-sized networks and are not suitable for networks where IP addresses of hosts may change.

You can configure static ARP entries manually or using automatic scanning and fixed ARP. Manually configuring static ARP entries is advisable if there are only a few entries. In other cases, use automatic scanning and fixed ARP to configure the static ARP entries.

If a Layer 2 Ethernet interface functions as an outbound interface, you are advised to configure a long static ARP entry. To do so, specify the VLAN and outbound interface when configuring the entry.

When a device is connected to an NLB cluster and multi-interface ARP is used, you can configure only short static ARP entries. For details, see Connecting a Device to an NLB Cluster (Using Multi-Interface ARP).

Procedure

  1. Run system-view

    The system view is displayed.

  2. Configure static ARP entries manually or using automatic scanning and fixed ARP.

    • Manually configure static ARP entries.

      • When the outbound interface is a Layer 2 Ethernet interface, run the arp static ip-address mac-address vid vlan-id [ cevid ce-vid ] interface interface-type interface-number[.subinterface-number] command.
      • When the outbound interface is a Layer 3 Ethernet interface, run the arp static ip-address mac-address interface interface-type interface-number command.
      • When the VPN instance mapping the ARP entries needs to be specified, run the arp static ip-address mac-address vpn-instance vpn-instance-name command.
      • When short static ARP entries need to be configured, for example, if the device is connected to an NLB cluster and multi-interface ARP is used, run the arp static ip-address mac-address command.

      By default, no static ARP entry is configured on a device.

    • Use automatic scanning and fixed ARP to batch configure static ARP entries.

      1. Run the interface interface-type interface-number[.subinterface-number] command to enter the interface view or the sub-interface view.

      2. Run the arp scan [ start-ip-address to end-ip-address ] command to configure automatic ARP scanning. The device then automatically sends ARP Request packets to the neighbors, obtains the neighbors' MAC addresses, and creates dynamic ARP entries.
        • The start and end IP addresses for automatic ARP scanning must be in the same network segment as the IP address of the interface. In addition, the start IP address must be smaller than or equal to the end IP address. If the IP address range is not specified, the device scans only the neighbors within the same network segment as the primary IP address of the interface. The device does not scan the IP addresses that match ARP entries.
        • Automatic ARP scanning consumes a large number of system resources. You are advised to perform scanning when resource usage is low and not to perform other operations during scanning.
        • Automatic ARP scanning takes a long time if there is a large number of neighbors within the same network segment as the primary IP address of the interface. To stop the scanning, you can press Ctrl+C. The device will have learned dynamic ARP entries based on the ARP reply packets already received before scanning stopped. To check the dynamic ARP entries that the device has learned, run the display arp dynamic command.
      3. Run the arp fixup command to configure fixed ARP and convert the dynamic ARP entries learned by the interface into static ARP entries.
        • The number of static ARP entries that fixed ARP can convert depends on the number of static ARP entries supported by the device. If this number exceeds that supported by the device, excess dynamic ARP entries will not be converted and the system displays an error message.
        • The static ARP entries converted through fixed ARP are the same as the manually configured ARP entries. You can run the undo arp static command to delete entries one by one or the reset arp static command to delete entries all at once.

    Only S5720-EI, S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-H, S5731S-S, S5732-H, S6720-EI, S6720-HI, S6720S-EI, S6730-H, S6730S-H, S6730-S, and S6730S-S support sub-interface and cevid ce-vid parameters.

Verifying the Configuration

  • Run the display arp static command to verify all static ARP entries.

  • Run the display arp network net-number [ net-mask | mask-length ] static command to verify static ARP entries based on a network segment.

  • Run the display arp vpn-instance vpn-instance-name static command to verify static ARP entries based on a VPN instance.

Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >