CLI Reference Guide-R02

Chapter 9 | General Security Measures
ARP Inspection
– 350 –
◆ If multiple, identical invalid ARP packets are received consecutively on the
same VLAN, then the logging facility will only generate one entry in the log
buffer and one corresponding system message.
◆ The maximum number of entries that can be stored in the log buffer is
determined by the message-number parameter. If the log buffer fills up before a
message is sent, the oldest entry will be replaced with the newest one.
◆ The switch generates a system message on a rate-controlled basis determined
by the seconds values. After the system message is generated, all entries are
cleared from the log buffer.
Example
Console(config)#ip arp inspection log-buffer logs 1 interval 10
Console(config)#
ip arp inspection
validate
This command specifies additional validation of address components in an ARP
packet. Use the no form to restore the default setting.
Syntax
ip arp inspection validate
{dst-mac [ip [allow-zeros] [src-mac]] |
ip [allow-zeros] [src-mac] | src-mac}
no ip arp inspection validate
dst-mac - Checks the destination MAC address in the Ethernet header
against the target MAC address in the ARP body. This check is performed
for ARP responses. When enabled, packets with different MAC addresses
are classified as invalid and are dropped.
ip - Checks the ARP body for invalid and unexpected IP addresses.
Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.
Sender IP addresses are checked in all ARP requests and responses, while
target IP addresses are checked only in ARP responses.
allow-zeros - Allows sender IP address to be 0.0.0.0.
src-mac - Checks the source MAC address in the Ethernet header against
the sender MAC address in the ARP body. This check is performed on both
ARP requests and responses. When enabled, packets with different MAC
addresses are classified as invalid and are dropped.
Default Setting
No additional validation is performed
Command Mode
Global Configuration