BigIron RX Series Configuration Guide
991
53-1001810-01
Dynamic ARP inspection
35
ARP entries
DAI uses the IP/MAC mappings in the ARP table to validate ARP packets received on untrusted
ports.
ARP entries in the ARP table derive from the following:
•
Dynamic ARP – normal ARP learned from trusted ports.
•
Static ARP – statically configured IP/MAC/port mapping.
•
Inspection ARP – statically configured IP/MAC mapping, where the port is initially unspecified.
The actual physical port mapping will be resolved and updated from validated ARP packets.
Refer to
“Configuring an inspection ARP entry”
on page 992.
•
DHCP-Snooping ARP – information collected from snooping DHCP packets when DHCP
snooping is enabled on VLANs.
The status of an ARP entry is either pending or valid:
•
Valid – the mapping is valid, and the port is resolved. This is always the case for static ARP
entries.
•
Pending – for normal dynamic, inspection ARP, and DHCP-Snooping ARP entries before they
are resolved, and the port mapped. Their status changes to valid when they are resolved, and
the port mapped.
Refer to
“System reboot and the binding database”
on page 995.
Limits and restrictions
The following limits and restrictions apply when configuring DAI:
•
The maximum number of DHCP and static DAI entries depends on the maximum number of
ARP table entries allowed on the device. The BigIron RX Series switch can have up to 64,000
ARP entries. In a BigIron RX, you can use the system-max ip-arp command to change the
maximum number of ARP entries for the device.
Configuring DAI
Configuring DAI consists of the following steps.
1. Configure inspection ARP entries for hosts on untrusted ports. Refer to
“Configuring an
inspection ARP entry”
on page 992.
2. Enable DAI on a VLAN to inspect ARP packets. Refer to
“Enabling DAI on a VLAN”
on page 992.
3. Configure the trust settings of the VLAN members. ARP packets received on trusted ports
bypass the DAI validation process. ARP packets received on untrusted ports go through the DAI
validation process. Refer to
“Enabling trust on a port”
on page 992.
4. Enable DHCP snooping to populate the DHCP snooping IP-to-MAC binding database.
The following shows the default settings of DAI.
Feature
Default
Dynamic ARP Inspection
Disabled
Trust setting for ports
Untrusted
Summary of Contents for Brocade DCX
Page 40: ...xl BigIron RX Series Configuration Guide 53 1001810 01 ...
Page 72: ...lxxii BigIron RX Series Configuration Guide 53 1001810 01 ...
Page 88: ...16 BigIron RX Series Configuration Guide 53 1001810 01 Searching and filtering output 1 ...
Page 300: ...228 BigIron RX Series Configuration Guide 53 1001810 01 Displaying IP information 7 ...
Page 318: ...246 BigIron RX Series Configuration Guide 53 1001810 01 Deploying a LAG 8 ...
Page 418: ...346 BigIron RX Series Configuration Guide 53 1001810 01 SuperSpan 12 ...
Page 482: ...410 BigIron RX Series Configuration Guide 53 1001810 01 MRP CLI example 14 ...
Page 506: ...434 BigIron RX Series Configuration Guide 53 1001810 01 Displaying VSRP information 15 ...
Page 582: ...510 BigIron RX Series Configuration Guide 53 1001810 01 Viewing Layer 2 ACLs 20 ...
Page 634: ...562 BigIron RX Series Configuration Guide 53 1001810 01 Troubleshooting ACLs 21 ...
Page 642: ...570 BigIron RX Series Configuration Guide 53 1001810 01 Trunk formation 22 ...
Page 746: ...674 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIP filters 24 ...
Page 808: ...736 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPF information 25 ...
Page 938: ...866 BigIron RX Series Configuration Guide 53 1001810 01 Displaying MBGP information 27 ...
Page 950: ...878 BigIron RX Series Configuration Guide 53 1001810 01 Using secure copy 28 ...
Page 988: ...916 BigIron RX Series Configuration Guide 53 1001810 01 Clearing IS IS information 29 ...
Page 1054: ...982 BigIron RX Series Configuration Guide 53 1001810 01 Sample 802 1x configurations 33 ...
Page 1108: ...1036 BigIron RX Series Configuration Guide 53 1001810 01 sFlow 39 ...
Page 1190: ...1118 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIPng information 44 ...
Page 1270: ...1198 BigIron RX Series Configuration Guide 53 1001810 01 Displaying ACLs 47 ...
Page 1310: ...1238 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPFv3 information 48 ...
Page 1382: ...1310 BigIron RX Series Configuration Guide 53 1001810 01 Commands That Require a Reload D ...
Page 1435: ...BigIron RX Series Configuration Guide 1363 53 1001810 01 VSRP E ...
Page 1436: ...1364 BigIron RX Series Configuration Guide 53 1001810 01 VSRP E ...