Configuration Guide User guide

1930 FastIron Configuration Guide
53-1002494-02
Dynamic ARP inspection
Dynamic ARP inspection configuration
Configuring DAI consists of the following steps.
1. Configure inspection ARP entries for hosts on untrusted ports.Refer to “Configuring an
inspection ARP entry” on page 1930.
2. Enable DAI on a VLAN to inspect ARP packets.Refer to “Enabling DAI on a VLAN” on page 1930.
3. Configure the trust settings of the VLAN members. ARP packets received on trusted ports
bypass the DAI validation process. ARP packets received on untrusted ports go through the
DAI validation process.Refer to “Enabling trust on a port” on page 1931.
4. Enable DHCP snooping to populate the DHCP snooping IP-to-MAC binding database.
The following shows the default settings of DAI.
Configuring an inspection ARP entry
Static ARP and static inspection ARP entries need to be configured for hosts on untrusted ports.
Otherwise, when DAI checks ARP packets from these hosts against entries in the ARP table, it will
not find any entries for them, and the Brocade device will not allow and learn ARP from an
untrusted host.
When the inspection ARP entry is resolved with the correct IP/MAC mapping, its status changes
from pending to valid.
To configure an inspection ARP entry, enter a command such as the following.
Brocade(config)#arp 20.20.20.12 0001.0002.0003 inspection
This command defines an inspection ARP entry, mapping a device IP address 20.20.20.12 with its
MAC address 0001.0002.0003. The ARP entry will be in Pend (pending) status until traffic with the
matching IP-to-MAC is received on a port.
Syntax: [no] arp <ip-addr> <mac-addr> inspection
The <ip-addr> <mac-addr> parameter specifies a device IP address and MAC address pairing.
Enabling DAI on a VLAN
DAI is disabled by default. To enable DAI on an existing VLAN, enter the following command.
Brocade(config)#ip arp inspection vlan 2
The command enables DAI on VLAN 2. ARP packets from untrusted ports in VLAN 2 will undergo
DAI inspection.
Syntax: [no] ip arp inspection vlan <vlan-number>
The <vlan-number> variable specifies the ID of a configured VLAN.
Feature Default
Dynamic ARP Inspection Disabled
Trust setting for ports Untrusted