Juniper IGP - CONFIGURATION GUIDE V11.1.X Configuration Manual page 44

JUNOSe 11.0.x IP, IPv6, and IGP Configuration Guide
arp spoof-check
arp timeout
20
Address Resolution Protocol
Use to add a static (permanent) entry in the ARP cache.
To add a static entry in the ARP cache, specify the ipAddress, interfaceType and
interfaceSpecifier (as indicated in Interface Types and Specifiers in JUNOSe
Command Reference Guide ), and an optional MAC address
You can issue this command only for Fast Ethernet interfaces, Gigabit Ethernet
interfaces, 10-Gigabit Ethernet interfaces, and bridged Ethernet interfaces
configured over ATM 1483.
Example
host1(config)#arp 192.56.20.1 gig 2/0 0090.1a00.0170
Use the no version to remove an entry from the ARP cache.
See arp
Use to configure the router to check for spoofed ARP packets received on an IP
interface.
By default, E Series routers check all received ARP packets for spoofing and
process only those ARP packets whose source IP address is outside the range of
the network mask. ARP packets with a source IP address of 0.0.0.0 and the
router IP address as the destination address are dropped because the router
identifies them as spoofed packets.
In networks with digital subscriber line access multiplexers (DSLAMs), even if
you configure the router to check for spoofed ARP packets, DSLAMs perform
this task instead of the router. If you disable checking for spoofed ARP packets
on the router in such networks, DSLAMs forward the received packets to the
router for processing. You can, therefore, configure the router accordingly,
depending on the way in which you want spoof-checking to be performed.
You cannot configure ARP spoof-checking on interfaces that do do support ARP,
such as loopback interfaces and ATM point-to-point PVCs.
If you disable checking for spoofed ARP packets, all packets received by the
router are processed.
You can reenable checking for spoofed ARP packets on an interface at any time
by using the arp spoof-check command after disabling it.
Example Shows how to disable spoof-checking for ARP packets received on a
Gigabit Ethernet interface and then reenable it.
host1(config-if)#interface gigabitEthernet 1/1
host1(config-if)#no arp spoof-check
host1(config-if)#arp spoof-check
Use the no version to disable checking for spoofed ARP packets received on a
major IP interface or an IP subinterface.
See arp spoof-check.