Edge-Core ECS4660-28F, Management Manual, Page: 1149 / 2020

C
HAPTER
29
| General Security Measures
ARP Inspection
– 1149 –
E
XAMPLE
Console(config)#ip arp inspection log-buffer logs 1 interval 10
Console(config)#
ip arp inspection
validate
This command specifies additional validation of address components in an
ARP packet. Use the no form to restore the default setting.
S
YNTAX
ip arp inspection validate
{ dst-mac [ ip [ allow-zeros ] [ src-mac ]] |
ip [ allow-zeros ] [ src-mac ]] | src-mac }
no ip arp inspection validate
dst-mac - Checks the destination MAC address in the Ethernet
header against the target MAC address in the ARP body. This check
is performed for ARP responses. When enabled, packets with
different MAC addresses are classified as invalid and are dropped.
ip - Checks the ARP body for invalid and unexpected IP addresses.
Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast
addresses. Sender IP addresses are checked in all ARP requests and
responses, while target IP addresses are checked only in ARP
responses.
allow-zeros - Allows sender IP address to be 0.0.0.0.
src-mac - Checks the source MAC address in the Ethernet header
against the sender MAC address in the ARP body. This check is
performed on both ARP requests and responses. When enabled,
packets with different MAC addresses are classified as invalid and
are dropped.
D
EFAULT
S
ETTING
No additional validation is performed
C
OMMAND
M
ODE
Global Configuration
C
OMMAND
U
SAGE
By default, ARP Inspection only checks the IP-to-MAC address bindings
specified in an ARP ACL or in the DHCP Snooping database.
E
XAMPLE
Console(config)#ip arp inspection validate dst-mac
Console(config)#