2-618
Catalyst 6500 Series Switch Command Reference—Release8.4
OL-6244-01
Chapter2 Catalyst 6500 Series Switch and ROM Monitor Commands
set security acl arp-inspection
set security acl arp-inspection
To configure Address Resolution Protocol (ARP) inspection features, use the set security acl
arp-inspection command.
set security acl arp-inspection {match-mac | address-validation}
{enable | [drop [log]] | disable}
set security acl arp-inspection dynamic {enable | disable} vlanlist
set security acl arp-inspection dynamic log {enable | disable}
Syntax Description
Defaults The MAC address matching, address validation, DAI, and the DAI logging features are disabled.
Command Types Switch command.
Command Modes Privileged.
Usage Guidelines When you enter the set security acl arp-inspection match-mac enable command, the system drops
packets in which the source Ethernet address in the Ethernet header is not the same as the source MAC
address in the ARP header.
When you enter the set security acl arp-inspection address-validation enable command, the system
drops packets that have illegal IP or MAC addresses.
The following IP addresses are illegal:
•0.0.0.0
•255.255.255.255
•Class D multicast IP addresses
match-mac Specifies the MAC address matching feature.
address-validation Specifies the address validation feature.
enable Enables the specified ARP inspection feature.
drop (Optional) Indicates to drop match-mac or address-validation packets.
log (Optional) Enables logging of match-mac or address-validation packets
that are dropped.
disable Disables the specified ARP inspection feature.
dynamic Specifies the Dynamic ARP Inspection (DAI) bindings feature for a list of
VLANs.
vlanlist VLANs included in DAI.
log Specifies logging for DAI.