Brocade Communications Systems Brocade ICX 6650 6650 - Manual (Page 302)

282 Brocade ICX 6650 Security Configuration Guide
53-1002601-01
Dynamic ARP inspection
Dynamic ARP inspection configuration
Configuring DAI consists of the following steps.
1. Configure inspection ARP entries for hosts on untrusted ports.Refer to “Configuring an
inspection ARP entry” on page 282.
2. Enable DAI on a VLAN to inspect ARP packets.Refer to “Enabling DAI on a VLAN” on page 282.
3. Configure the trust settings of the VLAN members. ARP packets received on trusted ports
bypass the DAI validation process. ARP packets received on untrusted ports go through the DAI
validation process.Refer to
“Enabling trust on a port” on page 283.
4. Enable DHCP snooping to populate the DHCP snooping IP-to-MAC binding database.
The following shows the default settings of DAI.
Configuring an inspection ARP entry
Static ARP and static inspection ARP entries need to be configured for hosts on untrusted ports.
Otherwise, when DAI checks ARP packets from these hosts against entries in the ARP table, it will
not find any entries for them, and the Brocade device will not allow and learn ARP from an
untrusted host.
When the inspection ARP entry is resolved with the correct IP/MAC mapping, its status changes
from pending to valid.
To configure an inspection ARP entry, enter a command such as the following.
Brocade(config)# arp 10.20.20.12 0000.0002.0003 inspection
This command defines an inspection ARP entry, mapping a device IP address 10.20.20.12 with its
MAC address 0000.0002.0003. The ARP entry will be in Pend (pending) status until traffic with the
matching IP-to-MAC is received on a port.
Syntax: [no] arp ip-addr mac-addr inspection
The ip-addr mac-addr parameter specifies a device IP address and MAC address pairing.
Enabling DAI on a VLAN
DAI is disabled by default. To enable DAI on an existing VLAN, enter the following command.
Brocade(config)# ip arp inspection vlan 2
The command enables DAI on VLAN 2. ARP packets from untrusted ports in VLAN 2 will undergo
DAI inspection.
Syntax: [no] ip arp inspection vlan vlan-number
The vlan-number variable specifies the ID of a configured VLAN.
TABLE 70 Default DAI settings
Feature Default
Dynamic ARP Inspection Disabled
Trust setting for ports Untrusted