To Next Page

To Previous Page

set arpinspection validate

17-22 DHCP Snooping and Dynamic ARP Inspection

set arpinspection validate

UsethiscommandtoconfigureadditionaloptionalARPvalidationparameters.

Syntax

set arpinspection validate {[src-mac] [dst-mac] [ip]}

Parameters

Defaults

Allparametersareoptional,butatleastoneparametermustbespecified.

Mode

Switchcommand,read‐write.

Usage

ThiscommandaddsadditionalvalidationofARPpacketsby DAI,beyondthebasicvalidation

thattheARPpacket’ssenderMACaddressandsenderIPaddressmatchanentryintheDHCP

snoopingbindingsdatabase.

Example

ThisexampleaddstheoptionalverificationthatsenderMACaddressesarethesameasthesource

MACaddressesintheEthernetheadersofARPpackets.

C2(su)->set arpinspection validate src-mac

set arpinspection limit

UsethiscommandtoconfigureratelimitingparametersforincomingARPpacketsonaportor

ports

Syntax

set arpinspection limit port port-string {none | rate pps {burst interval secs]}

src‐mac Specifiesthat DAIshouldverifythatthesenderMACaddressequals

thesourceMACaddressintheEthernetheader.

dst‐mac SpecifiesthatDAIshouldverifythatthetargetMACaddressequalsthe

destinationMACaddressintheEthernetheader.

ThischeckonlyappliestoARPresponses,sincethetargetMAC

address

isunspecifiedinARPrequests.

ip SpecifiesthatDAIshouldchecktheIPaddressanddropARPpackets

withaninvalidaddress.Aninvalidaddressisoneofthefollowing:

• 0.0.0.0

• 255.255.255.255

• All IP multicast addresses

• All class E addresses (240.0.0.0/4)

• Loopback addresses (in the range 127.0.0.0/8)

Enterasys SecureStack C2 C2G170-24 User Manual

Other manuals for Enterasys SecureStack C2 C2G170-24