How To Perform Validation Checks - Cisco Catalyst 2960-XR Security Configuration Manual
Ios release 15.0 2 ex1
Hide thumbs
Also See for Catalyst 2960-XR:
- Configuration manual (196 pages) ,
- Configuration manuals (120 pages) ,
- Reference (52 pages)
Table of Contents
Advertisement
Configuring Dynamic ARP Inspection
Command or Action
Step 7
show ip arp inspection interfaces
show errdisable recovery
Step 8
copy running-config startup-config
How to Perform Validation Checks
Dynamic ARP inspection intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings.
You can configure the switch to perform additional checks on the destination MAC address, the sender and
target IP addresses, and the source MAC address. Beginning in privileged EXEC mode, follow these steps to
perform specific checks on incoming ARP packets.
This procedure is optional.
To disable checking, use theno ip arp inspection validate [src-mac] [dst-mac] [ip] global configuration
command. To display statistics for forwarded, dropped, and MAC and IP validation failure packets, use the
show ip arp inspection statistics privileged EXEC command.
SUMMARY STEPS
1. configure terminal
2. ip arp inspection validate {[src-mac] [dst-mac] [ip]}
3. exit
4. show ip arp inspection vlan vlan-range
5. copy running-config startup-config
DETAILED STEPS
Command or Action
Step 1
configure terminal
Step 2
ip arp inspection validate
{[src-mac] [dst-mac] [ip]}
OL-29434-01
Purpose
Verify your settings.
(Optional) Save your entries in the configuration file.
Purpose
Enter global configuration mode.
Perform a specific check on incoming ARP packets. By default, no checks are performed.
The keywords have these meanings:
• For src-mac, check the source MAC address in the Ethernet header against the
sender MAC address in the ARP body. This check is performed on both ARP
requests and responses. When enabled, packets with different MAC addresses are
classified as invalid and are dropped.
• For dst-mac, check the destination MAC address in the Ethernet header against
the target MAC address in ARP body. This check is performed for ARP responses.
When enabled, packets with different MAC addresses are classified as invalid and
are dropped.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
How to Perform Validation Checks
209
Hide quick links:
Advertisement
Table of Contents
