《2020网络ARP-DETECTION故障排查.docx》由会员分享,可在线阅读,更多相关《2020网络ARP-DETECTION故障排查.docx(6页珍藏版)》请在第壹文秘上搜索。
1、ARP-DETECTIoN故障排查APX-DETECTI。敌传排查一、开始定位故障思路是:开始先检查ARP-DETECTION是否正确使能。如果配置无问题,再看目的端口是否为ARP信任端口。如果不是ARP信任端口,则需要进行用户的合法性检查。关于用户合法性检查,首先进行的是匹配ARP规则,如果匹配,则按照规则处理,如果不匹配,则查看是否匹配IPSOURCEGUARDo关于IP-SOURCE-GUARD的匹配,如果找到对应的IP表项,则判断是否非法,如果不匹配,则查看是否匹配OUI-MAC、DOTlX、DHCP-SNOOPING的其中一项。1、检查ARP-DETEcnON的酉己置查看ARP-DE
2、TECTlON在设备上对应的VLAN中是否使能。如果未使能,则进行下一步处理。命令:displayarpdetection例如:ARP-DETECTION在VLAN10中使能,则有如下显示H3CdisarpdetectionARPdetectionisenabledinthefollowingVLANs:1,102、检查ARP信任端口的配置查看该ARP所在或所应该的端口是否为信任端口,如果不为信任端口,则进行下一步处理。命令:displaythis例如:TEN5/0/1为ARP信任端口H3C-Ten-GigabitEthernet5/0/1displaythisportlink-modebri
3、dgeportlink-typehybridporthybridvlan1untaggedarpdetectiontrust3、匹配配置规则查看在设备上是否配置了ARP的规则。如果匹配,则按照规则处理(Permit/deny),如果未匹配,则进行下一步处理。命令:displayarpdetection例如:IP为LLLO/24,MAC为2222-2222-2200/ffff-ffff-ffOO的ARP,被丢弃。H3CdisplayarpdetectionARPdetectionisenabledinthefollowingVLANs:1j10ARPdetection:arpdetection0
4、denyip1.1.1.0255.255.255.0mac2222-2222-2200ffff-ffff-ffOO4、匹配IPSOURCE-GUARD查看是否匹配IPSOURCE叵AdministratorGUARD的静态配置。如果找到了对应源I耳JtLAdministrator2015-12-12 07:09:15址不符,认为i刻RP报文非法,进行丢弃。产到对应的,认为合法,进行转发一里未匹配,则进行彳!I继续进行 dhcp snooping,802.1 x1oui mac植命令:displayipsourcebindingII例如:LLLlOoo2-0002-0002的ARP报文会被丢弃,
5、1.Illl-版权所有:杭州华三通信技术有限公司Illl报文符合静态绑定表项,会正常学到,其他IP地址非LLLI的ARP正常学习。displayipsourcebindingTotalentriesfound:1MACAddressIPAddressVLANInterfaceType0011-1111-11111.1.1.1N/AGE1O28Static5、匹配OUl-MAC、DOTlX、DHCP-SNOOPING检查源MAC是否为OUl-MAC,VOICEVLAN是否使能;如果未匹配,则进行下一步处理。命令:displayvoicevlanouidisplayvoicevlanstate例如
6、:查看交换机上目前配置的。UI-MAC如下且端口Ten-GigabitEthernet5/0/1使能了VOiCevlan。H3CdisvoicevlanouiOuiAddressMaskDescription0001-e300-0000ffff-ff00-0000Siemensphone0003-6b00-0000ffff-ff00-0000Ciscophone0004-0d00-0000ffff-ff00-0000Avayaphone0060-b900-0000ffff-ff00-0000Philips/NECphoneOOdO-Ie00-0000ffff-ff00-0000Pingtelp
7、hone00e0-7500-0000ffff-ff00-0000Polycomphone00e0-bb00-0000ffff-ff00-00003comphoneH3CdisvoicevlanstateMaximumofVoiceVLANs:128CurrentVoiceVLANs:1VoiceVLANsecuritymode:SecurityVoiceVLANagingtime:1440minutesVoiceVLANenabledportanditsmode:PORTVLANMODECOSDSCPTen-GigabitEthernetBZOZl2AUTO646检查IP、MAC是否匹配DHC
8、p-SNOOPlNG表项;如果未匹配,则进行下一步处理命令:displaydhcp-snooping例如:匹配1.1.LlIIIl-1111-1111的ARP正常学习,其符合dhcp-SnoOPing表项。H3Cdisdhcp-snoopingDHCPSnoopingisenabled.Theclientbindingtableforallports.Type:D-Dynamic,S-Static,R一-RecoveringTypeIPAddressMACAddressLeaseVLANSVLANInterfaceD1.1.1.11111-1111-111128612GigabitEthernetlZOZl检查源MAC是否为dotIx的mac。如果是,则正常学习。否则丢弃报文。命令:displayconnectionaccess-typedotlx例如:源MAC2c59-e501-a055是dotlx用户的MACoH3Cdisplayconnectionaccess-typedotlxSlot:1Index=23,Username=dot1xdot1xIP=NAIPv6=NAMAC=2c59-e501-a055Total1connect!on(s)matchedonslot1.