32-15
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter32 Understanding and Conf iguring Dynamic ARP Inspection
Configuring Dynamic ARP Inspection
To return to the default log buffer settings, use the no ip arp inspection log-buffer global configuration
command. To return to the default VLAN log settings, use the
no ip arp inspection vlan vlan-range logging {acl-match | dhcp-bindings} global configuration
command. To clear the log buffer, use the clear ip arp inspection log privileged EXEC command.
This example shows how to configure the number of entries for the log buffer to 1024. It also shows how
to configure your Catalyst 4500 series switch so that the logs must be generated from the buffer at the
rate of 100 per 10 seconds.
SwitchB# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
SwitchB(config)# ip arp inspection log-buffer entries 1024
SwitchB(config)# ip arp inspection log-buffer logs 100 interval 10
SwitchB(config)# end
SwitchB# show ip arp inspection log
Total Log Buffer Size : 1024
Syslog rate : 100 entries per 10 seconds.
Interface Vlan Sender MAC Sender IP Num Pkts Reason Time
---------- ---- -------------- --------------- --------- ----------- ----
Gi3/31 100 0002.0002.0003 170.1.1.2 5 DHCP Deny 02:05:45 UTC
Fri Feb 4 2005
SwitchB#
Step3 Switch(config)# [no] ip arp
inspection vlan vlan-range logging
{acl-match {matchlog | none} |
dhcp-bindings {all | none | permit}}
Controls the type of packets that are logged per VLAN. By default, all
denied or all dropped packets are logged. The term logged means the entry
is placed in the log buffer and a system message is generated.
The keywords have these meanings:
•For vlan-range, specify a single VLAN identified by VLAN ID number,
a range of VLANs separated by a hyphen, or a series of VLANs
separated by a comma. The range is 1 to 4094.
•For acl-match matchlog, log packets based on the ACE logging
configuration. If you specify the matchlog keyword in this command
and the log keyword in the permit or deny ARP access-list
configuration command, ARP packets permitted or denied by ACEs
with log keyword are logged.
•For acl-match none, do not log packets that match ACLs.
•For dhcp-bindings all, log all packets that match DHCP bindings.
•For dhcp-bindings none, do not log packets that match DHCP
bindings.
•For dhcp-bindings permit, log DHCP-binding permitted packets.
Step4 Switch(config)# exit Returns to privileged EXEC mode.
Step5 Switch# show ip arp inspection
log
Verifies your settings.
Step6 Switch# copy running-config
startup-config
(Optional) Saves your entries in the con figuration file.
Command Purpose