Mac Address Validation - Juniper JUNOSE SOFTWARE FOR E SERIES 11.3.X - IP-IPV6-IGP CONFIGURATION GUIDE 2010-10-31 Configuration Manual

ip proxy-arp

MAC Address Validation

Copyright © 2010, Juniper Networks, Inc.
ipAddress—IP address in four-part dotted-decimal format corresponding to the local
data link address
interfaceType—Interface type; see Interface Types and Specifiers in JunosE Command
Reference Guide
interfaceSpecifier—Particular interface; format varies according to interface type;
see Interface Types and Specifiers in JunosE Command Reference Guide
To clear all dynamic ARP entries, specify an asterisk (*).
Example
host1#clear arp
There is no no version.
See clear arp
Use to enable proxy ARP on an Ethernet or bridge1483 interface.
Proxy ARP is enabled by default.
Example
host1(config-if)#ip proxy-arp unrestricted
Use the no version to disable proxy ARP on the interface.
See ip proxy-arp
MAC address validation is a verification process performed on each incoming packet to
prevent spoofing on IP Ethernet-based interfaces, including bridged Ethernet interfaces.
When an incoming packet arrives on a layer 2 interface, the validation table is used to
compare the packet's source IP address with its MAC address. If the MAC address and
IP address match, the packet is forwarded; if it does not match, the packet is dropped.
NOTE: MAC address validation for bridged Ethernet interfaces is supported
only on OC12 ATM line modules on ERX routers and on OC3/OC12 ATM IOAs
on the E120 and E320 routers.
MAC address validation on the E Series router can be accomplished in two ways:
You can statically configure it on a physical interface via the arp validate command
You can enable DHCP to perform the function independently and dynamically. See
JunosE Link Layer Configuration Guide .
The arp validate command adds the IP-MAC address pair to the validation table
maintained on the physical interface.
Chapter 1: Configuring IP
21