15-31
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
OL-8978-04
Chapter 15 Configuring Access Control
Using VACLs in Your Network
The above set of rules allows only 00-00-00-01-00-02 to be advertised as the MAC address for IP address
10.0.0.1. Similarly, MAC address 00-00-00-02-00-03 is bound to IP address 20.0.0.1. The ARP packets
that advertise any other MAC addresses for 10.0.0.1 and 20.0.0.1 are dropped (achieved by the
deny
actions in lines 3 and 4). All other ARP packets are allowed to go through (achieved by the
permit
action
in line 5).
ARP Traffic-Inspection Configuration Guidelines
This section describes the guidelines for configuring ARP traffic inspection:
•
The ARP traffic-inspection clauses appear at the top of a VACL.
•
The maximum number of ARP traffic-inspection clauses that can be configured in a VACL is 128.
•
An ARP traffic-inspection ACE cannot be modified to become an IP ACE and vice versa.
•
An ARP traffic-inspection ACE cannot be inserted before an IP ACE and vice versa.
•
Do not use the generic deny/permit clauses with the ARP traffic-inspection clauses in the same
VACL. The generic ARP deny/permit clauses are installed using the
set security acl ip
acl_name
{
deny
|
permit
}
arp
command.
•
If the MSFC is the gateway for the hosts, you must allow the MSFC IP/MAC binding. We
recommend that the gateway IP/MAC binding be allowed when using ARP traffic inspection.
•
ARP traffic inspection uses the existing logging facility for the VACLs. After a packet traverses the
ARP traffic-inspection rules, if the result is a “permit,” the packet is forwarded to the destination
MAC address (or broadcast address). If the result is a “deny,” the packet is dropped and sent to the
VACL logging process if logging is enabled.
VACL logging uses the source MAC address and the following fields from the ARP header to define
a logging flow: source IP address, source MAC address, and ARP opcode (request, reply).
You can limit the number of logged flows by entering the
set security acl log maxflow
max_flows
command. However, the
set security acl log ratelimit
max_rate
command does not apply to the
ARP traffic inspection logged flows.
•
The RARP packets are not used to learn the ARP entries on the hosts and are harmless from an ARP
corruption perspective. The PFC2 and PFC3A/PFC3B/PFC3BXL do not distinguish between the
ARP and RARP packets. An ACE that is used to redirect the ARP packets to the CPU also redirects
the RARP packets. Global rate limiting is a rate limit for the ARP and RARP packets combined. The
ARP traffic-inspection rules do not apply to the RARP packets; the RARP packets are simply
forwarded. A generic ARP deny clause also denies the RARP packets. You can display the number
of RARP packets that are forwarded by entering the
show security acl arp-inspection statistics
command.
•
Mapping VACLs with the ARP traffic-inspection clauses to the management VLANs (sco/sc1
interfaces) is supported.
•
Even if a port is part of an EtherChannel, the drop and shutdown thresholds remain port based. The
thresholds are not part of the
match
that is required for the formation of an EtherChannel (after PAgP
identifies the
matched
EtherChannel links, it groups the ports into an EtherChannel).
•
Due to the way the hardware recognizes the ARP packets, the IP packets with source address 0.0.0.0,
destination address 0.0.0.0, and the IP protocol ICMP, are also redirected to the ARP
traffic-inspection task. Because these packets are invalid, they are dropped. The count of these
packets is displayed as part of the
show security acl arp-inspection statistics
command.
•
If the syslog messages are generated for every packet that is dropped by the ARP traffic-inspection
task, the console is overwhelmed with messages. To avoid this situation, only 40 syslog messages
are allowed per minute.
