Brocade Communications Systems 6650 Dynamic ARP inspection configuration, Enabling DAI on a Vlan

Dynamic ARP inspection

Dynamic ARP inspection configuration

Configuring DAI consists of the following steps.

1.Configure inspection ARP entries for hosts on untrusted ports.Refer to “Configuring an inspection ARP entry” on page 282.

2.Enable DAI on a VLAN to inspect ARP packets.Refer to “Enabling DAI on a VLAN” on page 282.

3.Configure the trust settings of the VLAN members. ARP packets received on trusted ports bypass the DAI validation process. ARP packets received on untrusted ports go through the DAI validation process.Refer to “Enabling trust on a port” on page 283.

4.Enable DHCP snooping to populate the DHCP snooping IP-to-MAC binding database.

The following shows the default settings of DAI.

TABLE 70	Default DAI settings
Feature		Default
Dynamic ARP Inspection		Disabled
Trust setting for ports		Untrusted

Configuring an inspection ARP entry

Static ARP and static inspection ARP entries need to be configured for hosts on untrusted ports. Otherwise, when DAI checks ARP packets from these hosts against entries in the ARP table, it will not find any entries for them, and the Brocade device will not allow and learn ARP from an untrusted host.

When the inspection ARP entry is resolved with the correct IP/MAC mapping, its status changes from pending to valid.

To configure an inspection ARP entry, enter a command such as the following.

Brocade(config)# arp 10.20.20.12 0000.0002.0003 inspection

This command defines an inspection ARP entry, mapping a device IP address 10.20.20.12 with its MAC address 0000.0002.0003. The ARP entry will be in Pend (pending) status until traffic with the matching IP-to-MAC is received on a port.

Syntax: [no] arp ip-addrmac-addrinspection

The ip-addrmac-addrparameter specifies a device IP address and MAC address pairing.

Enabling DAI on a VLAN

DAI is disabled by default. To enable DAI on an existing VLAN, enter the following command.

Brocade(config)# ip arp inspection vlan 2

The command enables DAI on VLAN 2. ARP packets from untrusted ports in VLAN 2 will undergo DAI inspection.

Syntax: [no] ip arp inspection vlan vlan-number

The vlan-numbervariable specifies the ID of a configured VLAN.

282	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01