Configuring Security
Configuring Dynamic ARP Inspection
Cisco 220 Series Smart Switches Administration Guide Release 1.1.0.x 228
16
• Destination MAC Address—Compares the packet’s destination MAC
address in the Ethernet header against the destination interface’s MAC
address. This check is performed for ARP responses.
• IP Address—Compares the ARP body for invalid and unexpected IP
addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP Multicast
addresses.
Packets with invalid ARP Inspection bindings are logged and dropped.
Interaction Between ARP Inspection and DHCP Snooping
If DHCP Snooping is enabled, ARP Inspection uses the DHCP Snooping Binding
database in addition to the ARP access control rules. If DHCP Snooping is not
enabled, only the ARP access control rules are used.
Table 1 ARP Default
Workflow to Configure ARP Inspection
To configure ARP Inspection:
STEP 1 Enable ARP Inspection and configure various options on the Security > ARP
Inspection > Properties page. See Configuring ARP Inspection Properties for
more details.
STEP 2 Configure interfaces as ARP trusted or untrusted on the Security > ARP Inspection
> Interface Settings page. See Configuring ARP Inspection Trusted Interfaces
for more details.
Option Default State
Dynamic ARP Inspection Disabled.
ARP Packet Validation Disabled.
ARP Inspection Enabled on
VLAN
Disabled.
Log Buffer Interval SYSLOG message generation for dropped
packets is enabled at 5 seconds interval.
To Next Page
Loading...
Need help?
General
