2-140
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
ip arp inspection validate
ip arp inspection validate
Use the
ip arp inspection
validate
global configuration command on the switch to perform specific
checks for dynamic Address Resolution Protocol (ARP) inspection. Use the
no
form of this command
to return to the default settings.
ip arp inspection validate
{[
src-mac
] [
dst-mac
] [
ip [allow zeros]
]}
no ip arp inspection validate
[
src-mac
] [
dst-mac
] [
ip [allow zeros]
]
Syntax Description
Defaults
No checks are performed.
Command Modes
Global configuration
Command History
src-mac
Compare the source MAC address in the Ethernet header against the sender MAC
address in the ARP body. This check is performed on both ARP requests and
responses.
When enabled, packets with different MAC addresses are classified as invalid and are
dropped.
dst-mac
Compare the destination MAC address in the Ethernet header against the target MAC
address in ARP body. This check is performed for ARP responses.
When enabled, packets with different MAC addresses are classified as invalid and are
dropped.
ip
Compare the ARP body for invalid and unexpected IP addresses. Addresses
include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.
Sender IP addresses are compared in all ARP requests and responses. Target IP
addresses are compared only in ARP responses.
allow-zeros
Modifies the IP validation test so that ARPs with a sender address of 0.0.0.0 (ARP
probes) are not denied.
Release
Modification
12.2(25)EY
This command was introduced.
12.2(37)SE
The allow-zero keyword was added.
