Chapter 9
| General Security Measures
ARP Inspection
– 307 –
â—†
When ARP Inspection is disabled globally, it is still possible to configure ARP
Inspection for individual VLANs. These configuration changes will only become
active after ARP Inspection is globally enabled again.
Example
Console(config)#ip arp inspection
Console(config)#
ip arp inspection filter
This command specifies an ARP ACL to apply to one or more VLANs. Use the
no
form to remove an ACL binding. Use the
no
form to remove an ACL binding.
Syntax
ip arp inspection filter
arp-acl-name
vlan
{vlan-id | vlan-range} [
static
]
no ip arp inspection filter
arp-acl-name
vlan
{vlan-id | vlan-range}
arp-acl-name - Name of an ARP ACL. (Maximum length: 16 characters)
vlan-id - VLAN ID. (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a hyphen,
or a random group of VLANs with each entry separated by a comma.
static
- ARP packets are only validated against the specified ACL, address
bindings in the DHCP snooping database is not checked.
Default Setting
ARP ACLs are not bound to any VLAN
Static mode is not enabled
Command Mode
Global Configuration
Command Usage
â—†
ARP ACLs are configured with the commands described on page 344.
â—†
If static mode is enabled, the switch compares ARP packets to the specified ARP
ACLs. Packets matching an IP-to-MAC address binding in a permit or deny rule
are processed accordingly. Packets not matching any of the ACL rules are
dropped. Address bindings in the DHCP snooping database are not checked.
â—†
If static mode is not enabled, packets are first validated against the specified
ARP ACL. Packets matching a deny rule are dropped. All remaining packets are
validated against the address bindings in the DHCP snooping database.
Example
Console(config)#ip arp inspection filter sales vlan 1
Console(config)#
To Next Page
Loading...
Need help?
General