Cisco Catalyst 4500 Series Administration Guide

52-20
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 52 Configuring Dynamic ARP Inspection
Configuring Dynamic ARP Inspection
To perform specific checks on incoming ARP packets, perform this task:
To disable checking, use the no ip arp inspection validate [src-mac] [dst-mac] [ip] global
configuration command. To display statistics for forwarded, dropped, MAC validation failure, and IP
validation failure packets, use the show ip arp inspection statistics privileged EXEC command.
This example shows how to configure source mac validation. Packets are dropped and an error message
may be generated when the source address in the Ethernet header does not match the sender hardware
address in the ARP body.
SwitchB# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
SwitchB(config)# ip arp inspection validate src-mac
SwitchB(config)# exit
SwitchB# show ip arp inspection vlan 100
Source Mac Validation : Enabled
Destination Mac Validation : Disabled
IP Address Validation : Disabled
Command Purpose
Step 1
Switch# configure terminal
Enters global configuration mode.
Step 2
Switch(config)# ip arp inspection
validate
{[src-mac] [dst-mac] [ip]}
Performs a specific check on incoming ARP packets. By default, no
additional checks are performed.
The keywords have these meanings:
• For src-mac, check the source MAC address in the Ethernet header
against the sender MAC address in the ARP body. This check is
performed on both ARP requests and responses. When enabled, packets
with different MAC addresses are classified as invalid and are dropped.
• For dst-mac, check the destination MAC address in the Ethernet header
against the target MAC address in ARP body. This check is performed
for ARP responses. When enabled, packets with different MAC
addresses are classified as invalid and are dropped.
• For ip, check the ARP body for invalid and unexpected IP addresses.
Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast
addresses. Sender IP addresses are checked in all ARP requests and
responses, and target IP addresses are checked only in ARP responses.
You must specify at least one of the keywords. Each command overrides the
configuration of the previous command; that is, if a command enables src
and dst mac validations, and a second command enables IP validation only,
the src and dst mac validations are disabled as a result of the second
command.
Step 3
Switch(config)# exit
Returns to privileged EXEC mode.
Step 4
Switch# show ip arp inspection
vlan vlan-range
Verifies your settings.
Step 5
Switch# copy running-config
startup-config
(Optional) Saves your entries in the configuration file.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E