Cisco Catalyst 2960-XR Security Configuration Manual page 230

How to Limit the Rate of Incoming ARP Packets
SUMMARY STEPS
1. configure terminal
2. interface interface-id
3. ip arp inspection limit {rate pps [burst interval seconds] | none}
4. exit
5. errdisable detect cause arp-inspection and errdisable recovery causearp-inspection errdisable
recovery interval interval
6. exit
7. show ip arp inspection interfaces show errdisable recovery
8. copy running-config startup-config
DETAILED STEPS
Command or Action
Step 1
configure terminal
Step 2 interface interface-id
Step 3 ip arp inspection limit {rate pps
[burst interval seconds] | none}
Step 4
exit
Step 5
errdisable detect cause arp-inspection
and errdisable recovery
causearp-inspection errdisable
recovery interval interval
Step 6
exit
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
208
Purpose
Enter global configuration mode.
Specify the interface to be rate-limited, and enter interface configuration
mode.
Limit the rate of incoming ARP requests and responses on the interface.
Limit the rate of incoming ARP requests and responses on the interface.
The default rate is 15 pps on untrusted interfaces and unlimited on trusted
interfaces. The burst interval is 1 second.
The keywords have these meanings:
• For rate pps, specify an upper limit for the number of incoming packets
processed per second. The range is 0 to 2048 pps.
• (Optional) For burst interval seconds, specify the consecutive interval
in seconds, over which the interface is monitored for a high rate of ARP
packets. The range is 1 to 15.
• For rate none, specify no upper limit for the rate of incoming ARP
packets that can be processed.
Return to global configuration mode.
(Optional) Enable error recovery from the dynamic ARP inspection
error-disabled state, and configure the dynamic ARP inspection recover
mechanism variables.
By default, recovery is disabled, and the recovery interval is 300 seconds.
For interval interval, specify the time in seconds to recover from the
error-disabled state. The range is 30 to 86400.
Return to privileged EXEC mode.
Configuring Dynamic ARP Inspection
OL-29434-01