(Optional) Configuring a Static ARP Entry

Context

Static ARP entries are manually configured and maintained. They will not be aged out or overridden by dynamic ARP entries. You can configure static ARP entries on a Layer 3 VXLAN gateway to improve communication security. Static ARP entries enable the local device and a specified device to communicate with each other using only specified MAC addresses. Attackers cannot modify mappings between IP addresses and MAC addresses in static ARP entries.

Procedure

Configure a static VXLAN ARP entry on an interface.
1. Run system-view
  The system view is displayed.
2. Run arp static ip-address mac-address bridge-domain bd-id [ vid vlan-id1 [ cevid vlan-id2 ] ] interface interface-type interface-number.subnum
  A static VXLAN ARP entry is configured on a Layer 2 sub-interface on a VXLAN access-side interface.
  
  Alternatively, run arp static ip-address mac-address bridge-domain bd-id [ vid vlan-id3 ] interface interface-type interface-number
  
  A VLAN-based static VXLAN ARP entry is configured on a VXLAN access-side interface.
  - If a static ARP entry already exists, the new configuration cannot be delivered.
  - The specified ip-address must be in the same network segment as the outbound interface address in the ARP entry.
  - To specify the vid vlan-id and cevid vlan-id parameters, set the same encapsulation type as that on the interface first.
  - When you configure a static ARP entry on an interface of the S6720-EI and S6720S-EI, you must configure a static MAC address entry for the MAC address in the ARP entry. Otherwise, the switch will broadcast traffic from this MAC address.
Configure a static ARP entry for a VXLAN tunnel.
1. Run system-view
  The system view is displayed.
2. Run arp static ip-address mac-address vni vni-id source-ipv6 ipv6-address peer-ipv6 ipv6-address
  A static ARP entry is configured for a VXLAN tunnel.
  - If a static ARP entry already exists, the new configuration cannot be delivered.
  - The specified IP address must be in the same network segment as the outbound interface address in the ARP entry.
  - Before you configure a static VXLAN ARP entry for a tunnel, a VXLAN tunnel must have been created.