Cisco Systems ME3400G2CSA Rate Limiting of ARP Packets, Relative Priority of ARP ACLs and DHCP Snooping Entries, Logging of Dropped Packets

19-4
Cisco ME 3400 EthernetAccess Switch SoftwareConfiguration Guide
78-17058-01
Chapter19 Configuring Dynamic ARP Inspection
Understanding Dynamic ARP Inspection
Dynamic ARP inspection ensures that hosts (on untrusted interfaces) conne ct ed to a switch run ning
dynamic ARP inspection do not poison the ARP caches of other hosts in the network. However, dynamic
ARP inspection does not prevent hosts in other portions of the network from poisoning the caches of the
hosts that are connected to a switch running dynamic ARP inspection.
In cases in which some switches in a VLAN run dynamic ARP inspection and other switches do not,
configure the interfaces connecting such switches as untrusted. However, to validate the bindings of
packets from nondynamic ARP inspection switches, configure the switch running dynamic ARP
inspection with ARP ACLs. When you cannot determine such bindings, at L ayer 3, iso late sw itche s
running dynamic ARP inspection from switches not running dynamic ARP inspe ction swi tches. For
configuration information, see the “Configuring ARP ACLs for Non-DHCP Environments” section on
page 19-8.
Note Depending on the setup of the DHCP server and the network, it might not be possible to valida te a given
ARP packet on all switches in the VLAN.
Rate Limiting of ARP Packets
The switch CPU performs dynamic ARP inspection validation checks; therefore, the number of
incoming ARP packets is rate-limited to prevent a denial-of-service attack. By default, the rate for
untrusted interfaces is 15 packets per second (pps). Trusted interfaces are not rate-limited. You can
change this setting by using the ip arp inspection limit interface configuration command.
When the rate of incoming ARP packets exceeds the configured limit, the switch places the port in the
error-disabled state. The port remains in that state until you intervene. You can use the errdisable
recovery global configuration command to enable error disable recovery so that ports automatically
emerge from this state after a specified timeout period.
For configuration information, see the “Limiting the Rate of Incoming ARP Packets” section on
page 19-10.
Relative Priority of ARP ACLs and DHCP Snooping Entries
Dynamic ARP inspection uses the DHCP snooping binding database for the list of valid IP-to-MAC
address bindings.
ARP ACLs take precedence over entries in the DHCP snooping binding database. The switch uses ACLs
only if you configure them by using the ip arp inspection filter vlan global configuration command.
The switch first compares ARP packets to user-configured ARP ACLs. If the ARP ACL denies the ARP
packet, the switch also denies the packet even if a valid binding exists in the database populated by
DHCP snooping.
Logging of Dropped Packets
When the switch drops a packet, it places an entry in the log buffer and then generates system messages
on a rate-controlled basis. After the message is generated, the switch clears the entry from the log b uf fer.
Each log entry contains flow information, such as the receiving VLAN, the port num ber, the source and
destination IP addresses, and the source and destination MAC addresses.