32-19
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter32 Understanding and Conf iguring Dynamic ARP Inspection
Configuring Dynamic ARP Inspection
To perform specific checks on incoming ARP packets, perform this task.
To disable checking, use the no ip arp inspection validate [src-mac] [dst-mac] [ip] global
configuration command. To display statistics for forwarded, dropped, MAC validation failure, and IP
validation failure packets, use the show ip arp inspection statistics privileged EXEC command.
This example shows how to configure source mac validation. Packets are dropped and an error message
may be generated when the source address in the Ether net header does not match the sender hardware
address in the ARP body.
SwitchB# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
SwitchB(config)# ip arp inspection validate src-mac
SwitchB(config)# exit
SwitchB# show ip arp inspection vlan 100
Source Mac Validation : Enabled
Destination Mac Validation : Disabled
IP Address Validation : Disabled
Vlan Configuration Operation ACL Match Static ACL
---- ------------- --------- --------- ----------
100 Enabled Active
Command Purpose
Step1 Switch# configure terminal Enters global configuration mode.
Step2 Switch(config)# ip arp inspection
validate {[src-mac] [dst-mac] [ip]} Performs a specific check on incoming ARP packets. By default, no
additional checks are performed.
The keywords have these meanings:
•For src-mac, check the source MAC address in the Ethernet header
against the sender MAC address in the ARP body. This check is
performed on both ARP requests and responses. When enabled, packets
with different MAC addresses are classified as invalid and are dropped.
•For dst-mac, check the destination MAC address in the Ethernet header
against the target MAC address in ARP body. This check is performed
for ARP responses. When enabled, packets with different MAC
addresses are classified as invalid and are dropped.
•For ip, check the ARP body for invalid and unexpected IP addresses.
Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast
addresses. Sender IP addresses are checked in all ARP requests and
responses, and target IP addresses are checked only in ARP responses.
You must specify at least one of the keywords. Each command overrides the
configuration of the previous command; that is, if a command enables src
and dst mac validations, and a second command enables IP validation only,
the src and dst mac validations are disabled as a result of the second
command.
Step3 Switch(config)# exit Returns to privileged EXEC mode.
Step4 Switch# show ip arp inspection
vlan
vlan-range
Verifies your settings.
Step5 Switch# copy running-config
startup-config
(Optional) Saves your entries in the con figuration file.