Brocade Communications Systems Brocade ICX 6650 6650 User Manual
Page 301
Brocade ICX 6650 Security Configuration Guide
281
53-1002601-01
Dynamic ARP inspection
•
DHCP-Snooping ARP – information collected from snooping DHCP packets when DHCP
snooping is enabled on VLANs.
The status of an ARP entry is either pending or valid:
•
Valid – the mapping is valid, and the port is resolved. This is always the case for static ARP
entries.
•
Pending – for normal dynamic and inspection ARP entries before they are resolved, and the
port mapped. Their status changes to valid when they are resolved, and the port mapped.
Refer to also
“System reboot and the binding database”
Configuration notes and feature limitations for DAI
The following limits and restrictions apply when configuring DAI:
•
To run Dynamic ARP Inspection, you must first enable support for ACL filtering based on VLAN
membership or VE port membership. To do so, enter the following commands at the Global
CONFIG Level of the CLI.
Brocade(config)# enable ACL-per-port-per-vlan
Brocade(config)# write memory
Brocade(config)# exit
Brocade# reload
NOTE
You must save the configuration and reload the software to place the change into effect.
•
Brocade recommends that you do not enable DAI on a trunk port.
•
The maximum number of DHCP and static DAI entries depends on the maximum number of
ARP table entries allowed on the device. A Brocade ICX 6650 Layer 2 switch can have up to
4096 ARP entries and a Brocade ICX 6650 Layer 3 switch can have up to 64,000 ARP entries.
In a Brocade ICX 6650 Layer 3 switch, you can use the system-max ip-arp command to change
the maximum number of ARP entries for the device.
However, only up to 1024 DHCP entries can be saved to flash.
•
ACLs are supported on member ports of a VLAN on which DHCP snooping and Dynamic ARP
Inspection (DAI) are enabled.
•
DAI is supported on a VLAN without a VE, or on a VE with or without an assigned IP address.