Arp Spoofing Prevention Commands - D-Link DXS-3600 Series Cli Reference Manual

DXS-3600 Series Layer 3 Managed 10Gigabit Ethernet Switch CLI Reference Guide
6.

ARP Spoofing Prevention Commands

6-1 ip arp spoofing-prevention
This command is used to configure an ARP Spoofing Prevention (ASP) entry of the gateway used for
preventing ARP poisoning attacks. Use the no form of the command to delete an ARP spoofing
prevention entry.
ip arp spoofing-prevention GATEWAY-IP GATEWAY-MAC interface INTERFACE-ID [,|-]
no ip arp spoofing-prevention GATEWAY-IP [interface INTERFACE-ID [,|-] ]
Parameters
GATEWAY-IP
GATEWAY-MAC
INTERFACE-ID
,
-
Default
By default, no entries exist.
Command Mode
Global Configuration Mode.
Command Default Level
Level: 12.
Usage Guideline
This command is used to configure the ARP spoofing prevention (ASP) entry to prevent spoofing of the
MAC address of the protected gateway. When an entry is created, ARP packets whose sender IP
address matches the gateway IP address, of an entry, but its sender MAC address field does not match
the gateway MAC address, of the entry, will be dropped by the system. The ASP will bypass the ARP
packets whose sender IP address doesn't match the configured gateway IP address.
If an ARP address matches a configured gateway's IP address, MAC address, and port list, then bypass
the Dynamic ARP Inspection (DAI) check no matter if the receiving port is ARP 'trusted' or 'untrusted'.
Only physical ports and port channel interfaces are valid interface to be specified.
Example
This example shows how to configure an ARP spoofing prevention entry with an IP address of
10.254.254.251 and MAC address of 00-00-00-11-11-11 and activate the entry at port Ethernet 1/0/10.
Switch#configure terminal
Switch(config)# ip arp spoofing-prevention 10.254.254.251 00-00-00-11-11-11 interface
ethernet 1/0/10
Specifies the IP address of the gateway.
Specifies the MAC address of the gateway. The MAC address setting
will replace the last configuration for the same gateway IP address.
Specifies the interface that will be activated or removed from active
interface list (in the no form of this command). An ARP entry won't be
checked, if the receiving port is not included in the specified interface
list.
(Optional) Specifies a number of interfaces or separate a range of
interfaces from a previous range. No space before and after the
comma.
(Optional) Specifies a range of interfaces. No space before and after
the hyphen.
88