Chapter 9
| General Security Measures
ARP Inspection
– 347 –
â—† The switch generates a system message on a rate-controlled basis determined
by the seconds values. After the system message is generated, all entries are
cleared from the log buffer.
Example
Console(config)#ip arp inspection log-buffer logs 1 interval 10
Console(config)#
ip arp inspection
validate
This command specifies additional validation of address components in an ARP
packet. Use the no form to restore the default setting.
Syntax
ip arp inspection validate
{dst-mac [ip [allow-zeros] [src-mac]] |
ip [allow-zeros] [src-mac]] | src-mac}
no ip arp inspection validate
dst-mac - Checks the destination MAC address in the Ethernet header
against the target MAC address in the ARP body. This check is performed
for ARP responses. When enabled, packets with different MAC addresses
are classified as invalid and are dropped.
ip - Checks the ARP body for invalid and unexpected IP addresses.
Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.
Sender IP addresses are checked in all ARP requests and responses, while
target IP addresses are checked only in ARP responses.
allow-zeros - Allows sender IP address to be 0.0.0.0.
src-mac - Checks the source MAC address in the Ethernet header against
the sender MAC address in the ARP body. This check is performed on both
ARP requests and responses. When enabled, packets with different MAC
addresses are classified as invalid and are dropped.
Default Setting
No additional validation is performed
Command Mode
Global Configuration
Command Usage
By default, ARP Inspection only checks the IP-to-MAC address bindings specified in
an ARP ACL or in the DHCP Snooping database.
Example
Console(config)#ip arp inspection validate dst-mac
Console(config)#
To Next Page
Loading...
Need help?
General