Arp Spoofing Prevention Commands - D-Link DGS-1510 Series Reference Manual

DGS-1510 Series Gigabit Ethernet SmartPro Switch CLI Reference Guide
6.

ARP Spoofing Prevention Commands

6-1 ip arp spoofing-prevention
This command is used to configure an ARP Spoofing Prevention (ASP) entry of the gateway used for
preventing ARP poisoning attacks. Use the no form of this command to delete an ARP spoofing
prevention entry.
ip arp spoofing-prevention GATEWAY-IP GATEWAY-MAC interface INTERFACE-ID [,|-]
no ip arp spoofing-prevention GATEWAY-IP [interface INTERFACE-ID [,|-] ]
Parameters
GATEWAY-IP
GATEWAY-MAC
INTERFACE-ID
,
-
Default
By default, no entries exist.
Command Mode
Global Configuration Mode.
Command Default Level
Level: 12.
Usage Guideline
This command is used to configure the ARP spoofing prevention (ASP) entry to prevent spoofing of
the MAC address of the protected gateway. When an entry is created, ARP packets whose sender IP
address matches the gateway IP address, of an entry, but its sender MAC address field does not
match the gateway MAC address, of the entry, will be dropped by the system. The ASP will bypass
the ARP packets whose sender IP address doesn't match the configured gateway IP address.
If an ARP address matches a configured gateway's IP address, MAC address, and port list, then
bypass the Dynamic ARP Inspection (DAI) check no matter if the receiving port is ARP 'trusted' or
'untrusted'.
Only physical ports and port channel interfaces are valid interface to be specified.
Example
This example shows how to configure an ARP spoofing prevention entry with an IP address of
10.254.254.251 and MAC address of 00-00-00-11-11-11 and activate the entry at port eth2/0/10 and
port channel 3.
Specifies the IP address of the gateway.
Specifies the MAC address of the gateway. The MAC address
setting will replace the last configuration for the same gateway IP
address.
Specifies the interface that will be activated or removed from active
interface list (in the no form of this command). An ARP entry won't
be checked, if the receiving port is not included in the specified
interface list.
(Optional) Specifies a number of interfaces or separate a range of
interfaces from a previous range. No space before and after the
comma.
(Optional) Specifies a range of interfaces. No space before and
after the hyphen.
85