Zte ZXR10 5250 Series - Figure 5-19 DAI Configuration Instancetopology

Chapter5ServiceConguration
DAIisrelatedtothetrustedstateoftheportoftheswitch.IfanARPpacketisreceived
onatrustedport,shieldallDAIdetections.IfanARPpacketisreceivedonanon-trusted
port,itmustpasstheDAIvaliditytest.
ConguringDAI
TheDAIcongurationincludesthefollowingcommands:
CommandFunction
zte(cfg)#setarp-inspectionvalidate{ip|dst-mac|
src-mac}{enable|disable}
Enablesordisablestheinspection
ofeacheldofanARPpacket.
zte(cfg)#setarp-inspectionvlan<vlanlist>{enable|disable}EnablesordisablesDAIfunction
basedontheVLAN.
zte(cfg)#setarp-inspectionport<portlist>{trust|untrust}Setsaporttoatrustedoruntrusted
port.
zte(cfg)#setarp-inspectionport<portlist>limit{<1-100>|
infinite}
SetsthemaximumnumberofARP
packetsintheunittime.
showarp-inspection(allcongurationmodes)DisplaysDAIfunctionconguration
information.
DAICongurationInstance
lCongurationDescription
WhenDHCPsnoopingisenabled,checkARPpacketvalidityandthecorresponding
relationbetweenMAC,IPandVLAN.Anillegalpacketisdropped,andthespeedof
sendingARPpacketsonanon-trustedporttotheCPUislimited.SeeFigure5-19.
Figure5-19DAICongurationInstanceTopology
lCongurationProcedure
zte(cfg)#setdhcpsnooping-and-option82enable
zte(cfg)#setdhcpsnoopingaddport49,50
zte(cfg)#setdhcpport49client
zte(cfg)#setdhcpport50server
zte(cfg)#showdhcpsnooping
5-69
SJ-20131111172707-002|2013-11-27(R1.0)ZTEProprietaryandCondential