462
ARP detection configuration commands
NOTE:
The commands of this feature are supported only when SAP modules operate in bridge mode.
arp detection
Use
arp detection
to configure a user validity check rule.
Use
undo arp detection
to restore the default.
Syntax
arp detection
id-number
{
deny
|
permit
}
ip
{
any
|
ip-address
[
ip-address-mask
] }
mac
{
any
|
mac-address
[
mac-address-mask
] } [
vlan
vlan-id
]
undo arp detection
id-number
Default
No user validity check rule is specified.
Views
System view
Default command level
2: System level
Parameters
id-number
: Specifies the sequence number of the user validity check rule, in the range of 0 to 511.
The smaller the value, the higher the priority.
deny
: Denies the matching ARP packets.
permit
: Permits the matching ARP packets.
ip
{
any
|
ip-address
[
ip-address-mask
] }: Specifies the sender IP address range.
•
any
: Matches any sender IP address.
•
ip-address
: Matches a sender IP address.
•
ip
-
address
-
mask
: Specifies the mask for the sender IP address in dotted decimal format. If no
mask is specified, the
ip
-
address
argument specifies a host IP address.
mac
{
any
|
mac-address
[
mac-address-mask
] }: Specifies the sender MAC address range.
•
any
: Matches any sender MAC address.
•
mac
-
address
: Matches a sender MAC address, in the format of H-H-H.
•
mac-address-mask
: Specifies the mask for the sender MAC address, in the format of H-H-H.
•
vlan
vlan-id
: Specifies the ID of a VLAN where this rule applies, in the range of 1 to 4094.
Usage guidelines
Upon receiving an ARP packet, user validity check first compares the sender IP and MAC addresses
of the ARP packet against user validity check rules. If a matching rule is found, the ARP packet is
processed according to the rule. If no matching rule is found, the device compares the ARP packet's
sender IP and MAC addresses against the static IP source guard binding entries, the DHCP
snooping entries, 802.1X security entries, and OUI MAC addresses in turn.
