Catalyst 3750-E and 3560-E Switch Cisco IOS ... - DNIP . NET

Chapter 2Catalyst 3750-E and 3560-E Switch Cisco IOS Commandsip arp inspection validateip arp inspection validateUse the ip arp inspection validate global configuration command on the switch stack or on a standaloneswitch to perform specific checks for dynamic Address Resolution Protocol (ARP) inspection. Use theno form of this command to return to the default settings.ip arp inspection validate {[src-mac] [dst-mac] [ip [allow zeros] ]}no ip arp inspection validate [src-mac] [dst-mac] [ip [allow zeros] ]This command is available only if your switch is running the IP services feature set.Syntax Descriptionsrc-macdst-macipallow-zerosCompare the source MAC address in the Ethernet header against the sender MACaddress in the ARP body. This check is performed on both ARP requests andresponses.When enabled, packets with different MAC addresses are classified as invalid and aredropped.Compare the destination MAC address in the Ethernet header against the target MACaddress in ARP body. This check is performed for ARP responses.When enabled, packets with different MAC addresses are classified as invalid and aredropped.Compare the ARP body for invalid and unexpected IP addresses. Addresses include0.0.0.0, 255.255.255.255, and all IP multicast addresses.Sender IP addresses are compared in all ARP requests and responses. Target IPaddresses are checked only in ARP responses.Modifies the IP validation test so that ARPs with a sender address of 0.0.0.0 (ARPprobes) are not denied.DefaultsNo checks are performed.Command ModesGlobal configurationCommand HistoryRelease12.2(35)SE212.2(37)SEModificationThis command was introduced.The allow-zero keyword was added.OL-9776-08Catalyst 3750-E and 3560-E Switch Command Reference2-223