Ip Arp Inspection Validate - Cisco Catalyst 3560X-24P Command Reference Manual

ip arp inspection validate

ip arp inspection validate
Use the ip arp inspection validate global configuration command on the switch stack or on a standalone
switch to perform specific checks for dynamic Address Resolution Protocol (ARP) inspection. Use the
no form of this command to return to the default settings.
This command is available only if your switch is running the IP services feature set.
Syntax Description
src-mac
dst-mac
ip
allow-zeros
Defaults
No checks are performed.
Command Modes
Global configuration
Command History Release
12.2(53)SE2
Catalyst 3750-X and 3560-X Switch Command Reference
2-230
ip arp inspection validate {[src-mac] [dst-mac] [ip [allow zeros] ]}
no ip arp inspection validate [src-mac] [dst-mac] [ip [allow zeros] ]
Compare the source MAC address in the Ethernet header against the sender MAC
address in the ARP body. This check is performed on both ARP requests and
responses.
When enabled, packets with different MAC addresses are classified as invalid and are
dropped.
Compare the destination MAC address in the Ethernet header against the target MAC
address in ARP body. This check is performed for ARP responses.
When enabled, packets with different MAC addresses are classified as invalid and are
dropped.
Compare the ARP body for invalid and unexpected IP addresses. Addresses include
0.0.0.0, 255.255.255.255, and all IP multicast addresses.
Sender IP addresses are compared in all ARP requests and responses. Target IP
addresses are checked only in ARP responses.
Modifies the IP validation test so that ARPs with a sender address of 0.0.0.0 (ARP
probes) are not denied.
Modification
This command was introduced.
Chapter 2 Catalyst 3750-X and 3560-X Switch Cisco IOS Commands
OL-21522-02