Cisco Catalyst 4500 Series Software Configuration Manual page 1538

Configuring Dynamic ARP Inspection
Command
Step 5
Switch(config)# ip arp inspection filter arp-acl-name
vlan vlan-range
Step 6
Switch(config)# interface interface-id
Step 7
Switch(config-if)# no ip arp inspection trust
Step 8
Switch(config-if)# end
Step 9
Switch# show arp access-list
Switch# show ip arp inspection vlan vlan-range
Switch# show ip arp inspection interfaces
Step 10
Switch# copy running-config startup-config
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
58-12
[ ]
static
[ ]
acl-name
Chapter 58 Configuring Dynamic ARP Inspection
Purpose
Applies the ARP ACL to the VLAN. By default, no
defined ARP ACLs are applied to any VLAN.
• For arp-acl-name, specify the name of the ACL
created in Step 2.
For vlan-range, specify the VLAN that the
•
switches and hosts are in. You can specify a
single VLAN identified by VLAN ID number, a
range of VLANs separated by a hyphen, or a
series of VLANs separated by a comma. The
range is 1 to 4094.
• (Optional) Specify static to treat implicit denies
in the ARP ACL as explicit denies and to drop
packets that do not match any previous clauses in
the ACL. DHCP bindings are not used.
If you do not specify this keyword, it means that
there is no explicit deny in the ACL that denies
the packet, and DHCP bindings determine
whether a packet is permitted or denied if the
packet does not match any clauses in the ACL.
ARP packets containing only IP-to-MAC address
bindings are compared against the ACL. Packets are
permitted only if the access list permits them.
Specifies the Switch A interface that is connected to
Switch B, and enter interface configuration mode.
Configures the Switch A interface that is connected to
Switch B as untrusted.
By default, all interfaces are untrusted.
For untrusted interfaces, the switch intercepts all
ARP requests and responses. It verifies that the
intercepted packets have valid IP-to-MAC address
bindings before updating the local cache and before
forwarding the packet to the appropriate destination.
The switch drops invalid packets and logs them in the
log buffer according to the logging configuration
specified with the ip arp inspection vlan logging
global configuration command. For more
information, see the "Configuring the Log Buffer"
section on page 58-14.
Returns to privileged EXEC mode.
Verifies the DAI configuration.
(Optional) Saves your entries in the configuration
file.