Table of Contents
Advertisement
IP ARP Inspection Commands
ip arp inspection validate
ip arp inspection validate
Cisco 220 Series Smart Plus Switches Command Line Interface Reference Guide Release 1.0.0.x
To validate ARP packets on the switch, use the ip arp inspection validate Global
Configuration mode command.
To disable validating ARP packets, use the no form of this command.
Syntax
ip arp inspection validate {dst-mac | ip [allow-zeros] | src-mac}
no ip arp inspection validate {dst-mac | ip [allow-zeros] | src-mac}
Parameters
•
dst-mac—Compares the destination MAC address in the Ethernet header
against the target MAC address in ARP body. This check is performed for
ARP responses. When enabled, the packets with different MAC addresses
are classified as invalid and are dropped.
•
ip—Compares the ARP body for invalid and unexpected IP addresses.
Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.
Sender IP addresses are compared in all ARP requests and responses.
Target IP addresses are compared only in ARP responses.
•
allow-zeros—(Optional) Modifies the IP validation test so that ARPs with an
address of 0.0.0.0 are not denied.
•
src-mac—Compares the source MAC address in the Ethernet header
against the sender MAC address in ARP body. This check is performed on
both ARP requests and responses. When enabled, the packets with
different MAC addresses are classified as invalid and are dropped.
Default Configuration
Validating ARP packets is disabled.
Command Mode
Global Configuration mode
User Guidelines
You must specify at least one of the keywords. Each command overrides the
configuration of the previous command; that is, if a command enables src-mac and
dst-mac validations, and a second command enables IP validation only, the src-
mac and dst-mac validations are disabled as a result of the second command.
15
240
Advertisement
Table of Contents
