Management Guide - Kamery IP

General Security Measures3• The administrator can configure the log facility rate.• When the switch drops a packet, it places an entry in the log buffer, then generatesa system message on a rate-controlled basis. After the system message isgenerated, the entry is cleared from the log buffer.• Each log entry contains flow information, such as the receiving VLAN, the portnumber, the source and destination IP addresses, and the source and destinationMAC addresses.• If multiple, identical invalid ARP packets are received consecutively on the sameVLAN, then the logging facility will only generate one entry in the log buffer and onecorresponding system message.• If the log buffer is full, the oldest entry will be replaced with the newest entry.Trusted & Untrusted Ports• By default all ports are configured as untrusted.• Specific ports can be configured as trusted or untrusted ports.• Packets arriving on trusted interfaces bypass all ARP Inspection and ARPInspection Validation checks and will always be forwarded, while those arriving onuntrusted interfaces are subject to all configured ARP inspection tests.ARP Packet Rate Limiting• By default, all untrusted ports are subject to ARP packet rate limiting.• By default, all trusted ports are exempt from ARP packet rate limiting.• The switch will drop all ARP packets received on a port which exceeds theconfigured ARP-packets-per-second rate limit.• Setting the ARP Inspection Packet Rate Limit to “none” means that no rate limitingwill be enforced.Command Attributes• ARP Inspection Status – Enables ARP Inspection globally. (Default: Disabled)• ARP Inspection VLAN – Selects any configured VLAN. (Default: 1)• ARP Inspection VLAN Status – Enables ARP Inspection for the selected VLAN.(Default: Disabled)• ARP Inspection VLAN Filter- ARP ACL – Allows selection of any configured ARP ACLs. (Default: None)- Static – When an ARP ACL is selected, and static mode also selected, theswitch only performs ARP Inspection and bypasses validation against the DHCPSnooping Bindings database. When an ARP ACL is selected, but static mode isnot selected, the switch first performs ARP Inspection and then validationagainst the DHCP Snooping Bindings database. (Default: Disabled)• ARP Inspection Validation – Enables extended ARP Inspection Validation if anyof the following options are enabled. (Default: Disabled)- Dst-MAC – Validates the destination MAC address in the Ethernet headeragainst the target MAC address in the body of ARP responses.- IP – Checks the ARP body for invalid and unexpected IP addresses. Sender IP3-139