Table of Contents
Advertisement
Configuring Security
Configuring Dynamic ARP Inspection
STEP 1
STEP 2
Cisco 220 Series Smart Switches Administration Guide Release 1.1.0.x
•
Destination MAC Address—Compares the packet's destination MAC
address in the Ethernet header against the destination interface's MAC
address. This check is performed for ARP responses.
•
IP Address—Compares the ARP body for invalid and unexpected IP
addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP Multicast
addresses.
Packets with invalid ARP Inspection bindings are logged and dropped.
Interaction Between ARP Inspection and DHCP Snooping
If DHCP Snooping is enabled, ARP Inspection uses the DHCP Snooping Binding
database in addition to the ARP access control rules. If DHCP Snooping is not
enabled, only the ARP access control rules are used.
Table 1 ARP Default
Option
Dynamic ARP Inspection
ARP Packet Validation
ARP Inspection Enabled on
VLAN
Log Buffer Interval
Workflow to Configure ARP Inspection
To configure ARP Inspection:
Enable ARP Inspection and configure various options on the Security > ARP
Inspection > Properties page. See
more details.
Configure interfaces as ARP trusted or untrusted on the Security > ARP Inspection
> Interface Settings page. See
for more details.
Default State
Disabled.
Disabled.
Disabled.
SYSLOG message generation for dropped
packets is enabled at 5 seconds interval.
Configuring ARP Inspection Properties
Configuring ARP Inspection Trusted Interfaces
16
for
228
Hide quick links:
Advertisement
Table of Contents
