UMN:CLI User Manual
V5808
224
To activate/deactivate the ARP inspection function in the system, use the following
command.
ip arp inspection vlan VLANS
Activates ARP inspection on a specified VLAN.
VLANS: VLAN ID (1-4094)
no ip arp inspection vlan VLANS
Deactivates ARP inspection on a specified VLAN.
7.15.4.1 ARP Access List
You can exclude a given range of IP addresses from the ARP inspection using ARP
access lists. ARP access lists are created by the arp access-list command on the Global
Configuration mode. ARP access list permits or denies the ARP packets of a given range
of IP addresses.
To create/delete ARP access list (ACL), use the following command.
Opens ARP ACL configuration mode and creates an
ARP access list.
NAME: ARP access list name
Deletes an ARP access list.
arp access-list delete all
Deletes all ARP access lists.
After opening ARP Access List Configuration mode, the prompt changes from
SWITCH(config)# to SWITCH(config-arp-acl[NAME])#. After opening ARP ACL
Configuration mode, a range of IP addresses can be configured to apply ARP inspection.
By default, ARP Access List discards the ARP packets of all IP addresses and MAC
addresses.
To configure the range of IP address to deny ARP packets, use the following command.
deny ip any mac {any | host
MACADDR}
Discards all ARP packets of all IP addresses with all
MAC addresses which have not learned before on ARP
inspection table or a specific MAC address
any: ignores sender IP/MAC address
host: sender host
MACADDR: sender MAC address
deny ip host A.B.C.D mac {any |
host MACADDR}
Discards ARP packets from a specific host.
MACADDR: MAC address
deny ip range A.B.C.D A.B.C.D
mac any
Discards ARP packets of a given range of IP
addresses.
A.B.C.D: start/end IP address of sender
deny ip A.B.C.D/A mac {any |
host MACADDR}
Discards ARP packets of a sender IP network
addresses.
A.B.C.D/A: sender IP network address
To Next Page