Cisco Catalyst 3560-X Series, Руководство по настройке программного обеспечения

Страница: 689 / 1538

1-7
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
OL-25303-03
Chapter 1 Configuring Dynamic ARP Inspection
Configuring Dynamic ARP Inspection
EtherChannel ports is equal to the sum of the incoming rate of packets from all the channel
members. Configure the rate limit for EtherChannel ports only after examining the rate of incoming
ARP packets on the channel-port members.
The rate of incoming packets on a physical port is checked against the port-channel configuration
rather than the physical-ports configuration. The rate-limit configuration on a port channel is
independent of the configuration on its physical ports.
If the EtherChannel receives more ARP packets than the configured rate, the channel (including all
physical ports) is placed in the error-disabled state.
• Make sure to limit the rate of ARP packets on incoming trunk ports. Configure trunk ports with
higher rates to reflect their aggregation and to handle packets across multiple dynamic ARP
inspection-enabled VLANs. You also can use the
ip arp inspection limit none interface
configuration command to make the rate unlimited. A high rate-limit on one VLAN can cause a
denial-of-service attack to other VLANs when the software places the port in the error-disabled
state.
•
When you enable dynamic ARP inspection on the switch, policers that were configured to police
ARP traffic are no longer effective. The result is that all ARP traffic is sent to the CPU.
• When you configure dynamic ARP inspection smart logging, the contents of all packets in the log
buffer (by default, all dropped packets) are sent to a NetFlow collector. If you configure this feature,
make sure that smart logging is globally enabled. For more information about smart logging, see the
“Configuring Smart Logging” section on page 1-14 .
Configuring Dynamic ARP Inspection in DHCP Environments
This procedure shows how to configure dynamic ARP inspection when two switches support this feature.
Host 1 is connected to Switch A, and Host 2 is connected to Switch B as shown in
Figure 1-2 on
page 1-3 . Both switches are running dynamic ARP inspection on VLAN 1 where the hosts are located.
A DHCP server is connected to Switch A. Both hosts acquire their IP addresses from the same DHCP
server. Therefore, Switch A has the bindings for Host 1 and Host 2, and Switch B has the binding for
Host 2.
Note
Dynamic ARP inspection depends on the entries in the DHCP snooping binding database to verify
IP-to-MAC address bindings in incoming ARP requests and ARP responses. Make sure to enable DHCP
snooping to permit ARP packets that have dynamically assigned IP addresses. For configuration
information, see
Chapter 1, “Configuring DHCP Features and IP Source Guard.”
For information on how to configure dynamic ARP inspection when only one switch supports the
feature, see the
“Configuring ARP ACLs for Non-DHCP Environments” section on page 1-9 .
Beginning in privileged EXEC mode, follow these steps to configure dynamic ARP inspection. You must
perform this procedure on both switches. This procedure is required.
Command Purpose
Step 1
show cdp neighbors Verify the connection between the switches.
Step 2
configure terminal Enter global configuration mode.