Users Guide

Layer 2 Switching Commands 383
User Guidelines
By default Dynamic ARP Inspection validates the source MAC address and
source IP address in received ARP responses against the DHCP Snooping
bindings. ARP responses that fail the check are discarded without updating
the ARP cache. This command enables additional validation checks on ARP
response packets before updating the ARP cache. Any combination of checks
is allowed.
Each command invocation overrides the current configuration. For example,
if the existing configuration enables source MAC address and destination
MAC address validation and a command is issued to enable IP address
validation only, the source MAC address and destination MAC address
validations are disabled and IP address validation is enabled. Use the no form
of this command to disable all additional validation checks.
Example
console(config)#ip arp inspection validate src-mac dst-mac ip
console(config)#ip arp inspection validate src-mac ip
console(config)#ip arp inspection validate dst-mac ip
console(config)#ip arp inspection validate ip
ip arp inspection vlan
Use the ip arp inspection vlan command to enable Dynamic ARP Inspection
on a single VLAN or a range of VLANs. Use the no form of this command to
disable Dynamic ARP Inspection on a single VLAN or a range of VLANs.
Syntax
ip arp inspection vlan vlan-list [logging]
no ip arp inspection vlan vlan-list [logging]
• vlan- list —A list of VLAN identifiers. List separate, non-consecutive
VLAN IDs separated by commas (without spaces). Use a hyphen to
designate a range of IDs. (Range: 1–4093)
• logging — Use this parameter to enable logging of invalid packets.
Default Configuration
Dynamic ARP Inspection is disabled by default.