Cisco IE 4000, Software Configuration Manual

Page: 418 / 1066

414
Configuring Dynamic ARP Inspection
How to Configure Dynamic ARP Inspection
Configuring the Log Buffer
Command Purpose
1. configure terminal Enters global configuration mode.
2. ip arp inspection log-buffer { entries
number | logs number interval
seconds }
Configures the DAI logging buffer.
By default, when DAI is enabled, denied, or dropped, ARP packets are
logged. The number of log entries is 32. The number of system messages
is limited to 5 per second. The logging-rate interval is 1 second.

entries number —Specifies the number of entries to be logged in the
buffer. The range is 0 to 1024.

logs number interval seconds —Specifies the number of entries to
generate system messages in the specified interval.
logs number —Specifies the range 0 to 1024. A 0 value means that the
entry is placed in the log buffer, but a system message is not generated.
interval seconds —Specifies the range 0 to 86400 seconds (1 day). A 0
value means that a system message is immediately generated (and the
log buffer is always empty).
An interval setting of 0 overrides a log setting of 0.
The logs and interval settings interact. If the logs number X is greater than
interval seconds Y, X divided by Y (X/Y) system messages are sent every
second. Otherwise, one system message is sent every Y divided by X (Y/X)
seconds.
3. ip arp inspection vlan vlan-range
logging { acl-match { matchlog |
none } | dhcp-bindings { all | none |
permit }}
Controls the type of packets that are logged per VLAN. By default, all denied
or all dropped packets are logged. The term
logged means the entry is
placed in the log buffer and a system message is generated.

vlan-range —Specifies a single VLAN identified by VLAN ID number, a
range of VLANs separated by a hyphen, or a series of VLANs separated
by a comma. The range is 1 to 4096.

acl-match matchlog —Specifies log packets based on the ACE logging
configuration. If you specify the matchlog keyword in this command
and the log keyword in the permit or deny ARP access-list
configuration command, ARP packets permitted or denied by the ACL
are logged.

acl-match none —Does not log packets that match ACLs.

dhcp-bindings all —Logs all packets that match DHCP bindings.

dhcp-bindings none —Does not log packets that match DHCP bindings.

dhcp-bindings permit —Logs DHCP-binding permitted packets.
4. exit Returns to privileged EXEC mode.