Ip Arp Inspection Filter Vlan - Cisco Catalyst 3750 Metro Command Reference Manual

ip arp inspection filter vlan

ip arp inspection filter vlan
Use the ip arp inspection filter vlan global configuration command on the switch to permit or deny
Address Resolution Protocol (ARP) requests and responses from a host configured with a static IP
address when dynamic ARP inspection is enabled. Use the no form of this command to return to the
default settings.
This command is available only if your switch is running the enhanced multilayer image (EMI).
Syntax Description
arp-acl-name
vlan-range
static
Defaults No defined ARP ACLs are applied to any VLAN.
Command Modes Global configuration
Command History Release
12.2(25)EY
Usage Guidelines When an ARP ACL is applied to a VLAN for dynamic ARP inspection, only the ARP packets with
IP-to-MAC address bindings are compared against the ACL. If the ACL permits a packet, the switch
forwards it. All other packet types are bridged in the ingress VLAN without validation.
If the switch denies a packet because of an explicit deny statement in the ACL, the packet is dropped. If
the switch denies a packet because of an implicit deny statement, the packet is then compared against
the list of DHCP bindings (unless the ACL is static, which means that packets are not compared against
the bindings).
Use the arp access-list acl-name global configuration command to define the ARP ACL or to add
clauses to the end of a predefined list.
Catalyst 3750 Metro Switch Command Reference
2-132
ip arp inspection filter arp-acl-name vlan vlan-range [static]
no ip arp inspection filter arp-acl-name vlan vlan-range [static]
ARP access control list (ACL) name.
VLAN number or range.
You can specify a single VLAN identified by VLAN ID number, a range of
VLANs separated by a hyphen, or a series of VLANs separated by a comma.
The range is 1 to 4094.
(Optional) Specify static to treat implicit denies in the ARP ACL as explicit
denies and to drop packets that do not match any previous clauses in the
ACL. DHCP bindings are not used.
If you do not specify this keyword, it means that there is no explicit deny in
the ACL that denies the packet, and DHCP bindings determine whether a
packet is permitted or denied if the packet does not match any clauses in the
ACL.
Modification
This command was introduced.
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
OL-9645-10