Manualshelf

Configuration Guide User guide

ManualsBrandsBrocade ManualsComputer AccessoriesFastIron
1981198219831984198519861987198819891990
FastIron Configuration Guide 1929
53-1002494-02
Dynamic ARP inspection
• DHCP-Snooping ARP – information collected from snooping DHCP packets when DHCP
snooping is enabled on VLANs.
The status of an ARP entry is either pending or valid:
• Valid – the mapping is valid, and the port is resolved. This is always the case for static ARP
entries.
• Pending – for normal dynamic and inspection ARP entries before they are resolved, and the
port mapped. Their status changes to valid when they are resolved, and the port mapped.
Refer to also “System reboot and the binding database” on page 1933.
Configuration notes and feature limitations for DAI
The following limits and restrictions apply when configuring DAI:
• To run Dynamic ARP Inspection, you must first enable support for ACL filtering based on VLAN
membership or VE port membership. To do so, enter the following commands at the Global
CONFIG Level of the CLI.
Brocade(config)#enable ACL-per-port-per-vlan
Brocade(config)#write memory
Brocade(config)#exit
Brocade#reload
NOTE
You must save the configuration and reload the software to place the change into effect.
• Brocade recommends that you do not enable DAI on a trunk port.
• The maximum number of DHCP and static DAI entries depends on the maximum number of
ARP table entries allowed on the device. A FastIron Layer 2 switch can have up to 4096 ARP
entries and a FastIron Layer 3 switch can have up to 64,000 ARP entries. In a FastIron Layer 3
switch, you can use the system-max ip-arp command to change the maximum number of ARP
entries for the device.
However, only up to 1024 DHCP entries can be saved to flash.
• ACLs are supported on member ports of a VLAN on which DHCP snooping and Dynamic ARP
Inspection (DAI) are enabled.
• On FastIron X Series devices, DAI is supported together with multi-device port authentication
and dynamic ACLs. For details, refer to “Support for dynamic ARP inspection with dynamic
ACLs” on page 1852.
• DAI is supported on a VLAN without a VE, or on a VE with or without an assigned IP address.