CLI Reference Guide-R04

Chapter 9 | General Security Measures
ARP Inspection
– 366 –
arp-acl-name - Name of an ARP ACL. (Maximumlength:16characters)
vlan-id - VLAN ID. (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a hyphen,
or a random group of VLANs with each entry separated by a comma.
static - ARP packets are only validated against the specified ACL, address
bindings in the DHCP snooping database is not checked.
Default Setting
ARP ACLs are not bound to any VLAN
Static mode is not enabled
Command Mode
Global Configuration
Command Usage
◆ ARP ACL configuration commands are described under “ARP ACLs” on
page 399.
◆ If static mode is enabled, the switch compares ARP packets to the specified ARP
ACLs. Packets matching an IP-to-MAC address binding in a permit or deny rule
are processed accordingly. Packets not matching any of the ACL rules are
dropped. Address bindings in the DHCP snooping database are not checked.
◆ If static mode is not enabled, packets are first validated against the specified
ARP ACL. Packets matching a deny rule are dropped. All remaining packets are
validated against the address bindings in the DHCP snooping database.
Example
Console(config)#ip arp inspection filter sales vlan 1
Console(config)#