Specifications

Dynamic ARP Inspection Overview
SecureStack B2 Configuration Guide 18-17
Static Mappings
StaticmappingsareusefulwhenhostsconfigurestaticIPaddresses,DHCPsnoopingcannotbe
run,orotherswitchesinthenetworkdonotrundynamicARPinspection.Astaticmapping
associatesanIPaddresstoaMACaddressonaVLAN.DAIconsultsitsstaticmappingsbeforeit
consultsDHCPsnooping
—thus,staticmappingshaveprecedenceoverDHCPsnooping
bindings.
ARPACLsareusedtodefinestaticmappingsforDAI.Inthisimplementation,onlythesubsetof
ARPACLsyntaxrequiredforDAIissupported.ARPACLsarecompletelyindependentofACLs
usedforQoS.Amaximumof100ARP
ACLscanbeconfigured.WithinanACL,amaximumof20
rulescanbeconfigured.
Optional ARP Packet Validation
IfoptionalARPpacketvalidationhasbeenconfigured,DAIverifiesthatthesenderMACaddress
equalsthesourceMACaddressintheEthernetheader.Additionally,theoptiontoverifythatthe
targetMACaddressequalsthedestinat ionMACaddressintheEthernetheadercanbe
configured.Thischeckonlyappliesto
ARPresponses,sincethetargetMACaddressis
unspecifiedinARPrequests.
YoucanalsoenableIPaddresschecking.Whenthisoptionisenabled,DAIdropsARPpackets
withaninvalidIPaddress.ThefollowingIPaddressesareconsideredinvalid:
• 0.0.0.0
• 255.255.255.255
•AllIPmulticastaddresses
•AllclassEaddresses(240.0.0.0/4)
• Loopbackaddresses(in
therange127.0.0.0/8)
Logging Invalid Packets
Bydefault,DAIwritesalogmessagetothenormalbufferedlogforeachinvalidARPpacketit
drops.YoucanconfigureDAItonotloginvalidpacketsforspecificVLANs.
Packet Forwarding
DAIforwardsvalidARPpacketswhosedestinationMACaddressisnotlocal.TheingressVLAN
couldbeaswitchingorroutingVLAN.ARPrequestsarefloodedintheVLAN.ARPresponsesare
unicasttowardtheirdestination.DAIqueriestheMACaddresstabletodetermin ethe outgoing
port.IfthedestinationMAC
addressislocal,DAIgivesvalidARPpacketstotheARPapplication.
Rate Limiting
ToprotecttheswitchfromDHCPattackswhenDAIisenabled,theDAIapplicationenforcesarate
limitforARPpacketsreceivedonuntrustedinterfaces.DAImonitorsthereceiverateoneach
interfaceseparately.Ifthereceiverateexceedsaconfigurablelimit,DAIerrordisablesthe
interface,whicheffectivelybringsdown
theinterface.Youcanusethesetportenablecommand
toreenabletheport.
Youcanconfigureboththerateandtheburstinterval.Thedefaultrateis15ppsoneachuntrusted
interfacewitharangeof0to100pps.Thedefaultburstintervalis1secondwith
arangeto1to15
seconds..TheratelimitcannotbesetontrustedinterfacessinceARPpacketsreceivedontrusted
interfacesdonotcometotheCPU.