User manual

C HAPTER 4 | Configuring the Switch
Configuring Security
– 115 –
◆ By default, ARP Inspection is disabled both globally and on all ports.
■
If ARP Inspection is globally enabled, then it becomes active only on
the ports where it has been enabled.
■
When ARP Inspection is enabled globally, all ARP request and reply
packets on inspection-enabled ports are redirected to the CPU and
their switching behavior handled by the ARP Inspection engine.
■
If ARP Inspection is disabled globally, then it becomes inactive for
all ports, including those where inspection is enabled.
■
When ARP Inspection is disabled, all ARP request and reply packets
will bypass the ARP Inspection engine and their switching behavior
will match that of all other packets.
■
Disabling and then re-enabling global ARP Inspection will not affect
the ARP Inspection configuration of any ports.
■
When ARP Inspection is disabled globally, it is still possible to
configure ARP Inspection for individual ports. These configuration
changes will only become active after ARP Inspection is enabled
globally again.
◆ ARP Inspection uses the DHCP snooping bindings database for the list
of valid IP-to-MAC address bindings.
N OTE : DHCP snooping must be enabled for dynamic clients to be learned
automatically.
CONFIGURING GLOBAL AND PORT SETTINGS FOR ARP INSPECTION
Use the ARP Inspection Configuration page to enable ARP inspection
globally for the switch and for any ports on which it is required.
PATH
Advanced Configuration, Security, Network, ARP Inspection, Configuration
PARAMETERS
These parameters are displayed:
Global Configuration
◆ Mode – Enables Dynamic ARP Inspection globally. (Default: Disabled)
◆ Translate dynamic to static – Click to translate all dynamic entries to
static entries.
Port Mode Configuration
◆ Port – Port identifier