Ip Arp Inspection Validate - Cisco ME 3400 Command Reference Manual

Chapter 2 Cisco ME 3400 Ethernet Access Switch Cisco IOS Commands

ip arp inspection validate

Use the ip arp inspection validate global configuration command to perform specific checks for
dynamic Address Resolution Protocol (ARP) inspection. Use the no form of this command to return to
the default settings.
Syntax Description
src-mac
dst-mac
ip
allow-zeros
Defaults No checks are performed.
Command Modes Global configuration
Command History Release
12.2(25)EX
12.2(37)SE
12.2(50)SE
Usage Guidelines
You must specify at least one of the keywords. Each command overrides the configuration of the
previous command; that is, if a command enables src-mac and dst-mac validations, and a second
command enables IP validation only, the src-mac and dst-mac validations are disabled as a result of the
second command.
OL-9640-07
ip arp inspection validate {[src-mac] [dst-mac] [ip [allow zeros]]}
no ip arp inspection validate [src-mac] [dst-mac] [ip [allow zeros]]
Compare the source MAC address in the Ethernet header against the sender MAC
address in the ARP body. This check is performed on both ARP requests and
responses.
When enabled, packets with different MAC addresses are classified as invalid and are
dropped.
Compare the destination MAC address in the Ethernet header against the target MAC
address in ARP body. This check is performed for ARP responses.
When enabled, packets with different MAC addresses are classified as invalid and are
dropped.
Compare the ARP body for invalid and unexpected IP addresses. Addresses include
0.0.0.0, 255.255.255.255, and all IP multicast addresses.
Sender IP addresses are compared in all ARP requests and responses. Target IP
addresses are checked only in ARP responses.
Modifies the IP validation test so that ARPs with a sender address of 0.0.0.0 (ARP
probes) are not denied.
Modification
This command was introduced.
The allow-zeros keyword was added.
The command was supported in the metro base image.
Cisco ME 3400 Ethernet Access Switch Command Reference
ip arp inspection validate
2-131