Configuring Ip Packet Verification - Cisco Nexus 7000 Series Configuration Manual

Chapter 2 Configuring IPv4
S e n d d o c u m e n t c o m m e n t s t o n e x u s 7 k - d o c f e e d b a c k @ c i s c o . c o m .
Command
Step 3
ip arp gratuitous {request | update}
Example:
switch(config-if)# ip arp gratuitous
request
Step 4
copy running-config startup-config
Example:
switch(config-if)# copy running-config
startup-config
This example shows how to disable gratuitous ARP requests:
switch# config t
switch(config)# interface ethernet 2/3
switch(config-if)# no ip arp gratuitous request
switch(config-if)# copy running-config startup-config

Configuring IP Packet Verification

Cisco NX-OS supports an Intrusion Detection System (IDS) that checks for IP packet verification. You
can enable or disable these IDS checks.
To enable IDS checks, use the following commands in global configuration mode:
Command
hardware ip verify address {destination
zero | identical | reserved | source
{broadcast | multicast}}
hardware ip verify checksum
hardware ip verify fragment
OL-20002-02
Purpose
Enables gratuitous ARP on the interface. Default is
enabled.
(Optional) Saves this configuration change.
Purpose
Performs the following IDS checks on the IP address:
destination zero—Drops IP packets if the
•
destination IP address is 0.0.0.0.
identical—Drops IP packets if the source IP address
•
is identical to the destination IP address.
reserved—Drops IP packets if the IP address is in
•
the 127.x.x.x range.
source—Drops IP packets if the IP source address is
•
either 255.255.255.255 (broadcast) or in the
224.x.x.x range (multicast).
Drops IP packets if the packet checksum is invalid.
Drops IP packets if the packet fragment has a nonzero
offset and the DF bit is active.
Cisco Nexus 7000 Series NX-OS Unicast Routing Configuration Guide, Release 4.x
Configuring IPv4
2-13