Home » Dell Manuals » Hubs & Switches » Dell PowerConnect W-IAP Remote » Manual Viewer

Dell PowerConnect W-IAP Remote Configuration Guide - Page 618

Using ACLs to filter ARP packets, Configuration considerations, Configuring ACLs for ARP filtering

View all Dell PowerConnect W-IAP Remote manuals

Add to My Manuals
Save this manual to your list of manuals

Page 618 highlights

16 Using ACLs to filter ARP packets Specify the variable in the following formats: • PowerConnect B-Series FCX stackable switches - Using ACLs to filter ARP packets You can use ACLs to filter ARP packets. Without this feature, ACLs cannot be used to permit or deny incoming ARP packets. Although an ARP packet contains an IP address just as an IP packet does, an ARP packet is not an IP packet; therefore, it is not subject to normal filtering provided by ACLs. When a Dell PowerConnect device receives an ARP request, the source MAC and IP addresses are stored in the device ARP table. A new record in the ARP table overwrites existing records that contain the same IP address. This behavior can cause a condition called "ARP hijacking", when two hosts with the same IP address try to send an ARP request to the device. Normally ARP hijacking is not a problem because IP assignments are done dynamically; however, in some cases, ARP hijacking can occur, such as when a configuration allows a router interface to share the IP address of another router interface. Since multiple VLANs and the router interfaces that are associated with each of the VLANs share the same IP segment, it is possible for two hosts in two different VLANs to fight for the same IP address in that segment. ARP filtering using ACLs protects an IP host record in the ARP table from being overwritten by a hijacking host. Using ACLs to filter ARP requests checks the source IP address in the received ARP packet. Only packets with the permitted IP address will be allowed to be to be written in the ARP table; others are dropped. Configuration considerations • This feature is available on devices running Layer 3 code. This filtering occurs on the management processor. • The feature is available on physical interfaces and virtual routing interfaces. It is supported on the following physical interface types Ethernet and trunks. • ACLs used to filter ARP packets on a virtual routing interface can be inherited from a previous interface if the virtual routing interface is defined as a follower virtual routing interface. Configuring ACLs for ARP filtering To implement the ACL ARP filtering feature, enter commands such as the following. PowerConnect(config)# access-list 101 permit ip host 192.168.2.2 any PowerConnect(config)# access-list 102 permit ip host 192.168.2.3 any PowerConnect(config)# access-list 103 permit ip host 192.168.2.4 any PowerConnect(config)# vlan 2 PowerConnect(config-vlan-2)# tag ethe 1/1 to 1/2 PowerConnect(config-vlan-2)# router-interface ve 2 PowerConnect(config-vlan-2)# vlan 3 PowerConnect(config-vlan-3)# tag ethe 1/1 to 1/2 PowerConnect(config-vlan-3)#router-int ve 3 PowerConnect(config-vlan-3)# vlan 4 PowerConnect(config-vlan-4)# tag ethe 1/1 to 1/2 PowerConnect(config-vlan-4)# router-int ve 4 PowerConnect(config-vlan-4)# interface ve 2 PowerConnect(config-ve-2)# ip access-group 101 in PowerConnect(config-ve-2)# ip address 192.168.2.1/24 PowerConnect(config-ve-2)# ip use-ACL-on-arp 103 576 PowerConnect B-Series FCX Configuration Guide 53-1002266-01

Section	Page
Contents	3
About This Document	39
Introduction	39
Device nomenclature	39
Audience	39
Document conventions	40
Text formatting	40
Command syntax conventions	40
Notes, cautions, and danger notices	40
Notice to the reader	41
Related publications	41
Getting technical help	41
Contacting Dell	41
Getting Familiar with Management Applications	43
Using the management port	43
How the management port works	43
CLI Commands for use with the management port	44
Logging on through the CLI	45
On-line help	46
Command completion	46
Scroll control	46
Line editing commands	47
Using stack-unit, slot number, and port number with CLI commands	47
CLI nomenclature on Stackable devices	48
Searching and filtering output from CLI commands	48
Using special characters in regular expressions	50
Creating an alias for a CLI command	52
Logging on through the Web Management Interface	53
Navigating the Web Management Interface	54
Logging on through Brocade Network Advisor	58
Configuring Basic Software Features	59
Configuring basic system parameters	60
Entering system administration information	60
Configuring Simple Network Management Protocol (SNMP) parameters	61
Disabling Syslog messages and traps for CLI access	64
Cancelling an outbound Telnet session	65
Specifying a Simple Network Time Protocol (SNTP) server	65
Setting the system clock	67
Limiting broadcast, multicast, and unknown unicast traffic	69
Configuring CLI banners	71
Configuring a local MAC address for Layer 2 management traffic	74
Configuring basic port parameters	74
Assigning a port name	74
Modifying port speed and duplex mode	75
Enabling auto-negotiation maximum port speed advertisement and down-shift	75
Modifying port duplex mode	78
Configuring MDI/MDIX	79
Disabling or re-enabling a port	80
Configuring flow control	80
Configuring symmetric flow control on PowerConnect B-Series FCX devices	82
Configuring PHY FIFO Rx and Tx depth	86
Configuring the IPG on PowerConnect Stackable devices	86
Enabling and disabling support for 100BaseTX	87
Enabling and disabling support for 100BaseFX	87
Changing the Gbps fiber negotiation mode	88
Modifying port priority (QoS)	89
Dynamic configuration of Voice over IP (VoIP) phones	89
Configuring port flap dampening	90
Port loop detection	94
Operations, Administration, and Maintenance	99
Overview	99
Determining the software versions installed and running on a device	100
Determining the flash image version running on the device	100
Determining the boot image version running on the device	101
Determining the image versions installed in flash memory	101
Flash image verification	101
Image file types	103
Viewing the contents of flash files	103
Using SNMP to upgrade software	104
Changing the block size for TFTP file transfers	105
Rebooting	106
Configuration notes	106
Displaying the boot preference	106
Loading and saving configuration files	107
Replacing the startup configuration with the running configuration	107
Replacing the running configuration with the startup configuration	108
Logging changes to the startup-config file	108
Copying a configuration file to or from a TFTP server	108
Dynamic configuration loading	109
Maximum file sizes for startup-config file and running-config	111
Loading and saving configuration files with IPv6	111
Using the IPv6 copy command	111
Copying a file from an IPv6 TFTP server	112
Using the IPv6 ncopy command	113
Uploading files from an IPv6 TFTP server	114
Using SNMP to save and load configuration information	115
Erasing image and configuration files	116
Scheduling a system reload	116
Reloading at a specific time	116
Reloading after a specific amount of time	117
Displaying the amount of time remaining before a scheduled reload	117
Canceling a scheduled reload	117
Diagnostic error codes and remedies for TFTP transfers	117
Testing network connectivity	118
Pinging an IPv4 address	118
Tracing an IPv4 route	120
Software-based Licensing	121
Software license terminology	121
Software-based licensing overview	122
How software-based licensing works	122
License types	122
Non-licensed features	122
Licensed features and part numbers	123
Licensing rules	123
Configuration tasks	125
Obtaining a license	125
Installing a license file	130
Verifying the license file installation	130
Deleting a license	130
Other licensing options available from the Brocade Software Portal	131
Viewing software license information	131
Transferring a license	132
Syslog messages and trap information	132
Viewing information about software licenses	133
Viewing the License ID (LID)	133
Viewing the license database	134
Viewing software packages installed in the device	135
Stackable Devices	137
IronStack overview	137
IronStack technology features	137
Stackable models	138
IronStack terminology	138
Building an IronStack	140
IronStack topologies	140
Software requirements	142
IronStack construction methods	142
Scenario 1 - Configuring a three-member IronStack in a ring topology using secure-setup	143
Scenario 2 - Configuring a three-member IronStack in a ring topology using the automatic setup process	147
Scenario 3 - Configuring a three-member IronStack in a ring topology using the manual configuration process	150
Configuring an FCX IronStack	151
Configuring PowerConnect B-Series FCX stacking ports	151
Configuring a default stacking port to function as a data port	157
Verifying an IronStack configuration	158
Managing your IronStack	160
Logging in through the CLI	160
Logging in through Brocade Network Advisor	160
Logging in through the console port	160
IronStack management MAC address	162
Removing MAC address entries	164
CLI command syntax	166
IronStack CLI commands	166
Copying the flash image to a stack unit from the Active Controller	168
Reloading a stack unit	168
Controlling stack topology	168
Managing IronStack partitioning	169
MIB support for the IronStack	170
Persistent MAC address	170
Unconfiguring an IronStack	172
Displaying IronStack information	173
Adding, removing, or replacing units in an IronStack	189
Renumbering stack units	191
Syslog, SNMP, and traps	193
Troubleshooting an IronStack	193
Troubleshooting an unsuccessful stack build	194
Troubleshooting image copy issues	195
Stack mismatches	196
Image mismatches	196
Advanced feature privileges (PowerConnect B-Series FCX )	196
Configuration mismatch	197
Memory allocation failure	198
Recovering from a mismatch	198
Troubleshooting secure-setup	199
Troubleshooting unit replacement issues	200
More about IronStack technology	200
Configuration, startup configuration files and stacking flash	200
IronStack topologies	201
Port down and aging	201
Device roles and elections	201
PowerConnect B-Series FCX hitless stacking	204
Supported events	205
Non-supported events	205
Supported protocols and services	205
Configuration notes and feature limitations	207
What happens during a hitless stacking switchover or failover	208
Standby Controller role in hitless stacking	210
Support during stack formation, stack merge, and stack split	211
Hitless stacking default behavior	215
Hitless stacking failover	217
Hitless stacking switchover	218
Displaying information about hitless stacking	225
Syslog messages for hitless stacking failover and switchover	225
Displaying hitless stacking diagnostic information	226
Monitoring Hardware Components	231
Virtual cable testing	231
Configuration notes	231
Command syntax	231
Viewing the results of the cable analysis	232
Supported Fiber Optic Transceivers	233
Digital optical monitoring	234
Configuration limitations	234
Enabling digital optical monitoring	234
Setting the alarm interval	235
Displaying information about installed media	235
Viewing optical monitoring information	236
Syslog messages	238
Configuring IPv6 Management on PowerConnect B-Series FCXSwitches	239
IPv6 management overview	240
IPv6 addressing	240
Enabling and disabling IPv6	241
IPv6 management features	241
IPv6 management ACLs	241
IPv6 debug	242
IPv6 Web management using HTTP and HTTPS	242
IPv6 logging	243
Name-to-IPv6 address resolution using IPv6 DNS server	243
Defining an IPv6 DNS entry	243
IPv6 ping	244
SNTP over IPv6	245
SNMP3 over IPv6	245
Specifying an IPv6 SNMP trap receiver	245
Secure Shell, SCP, and IPv6	246
IPv6 Telnet	246
IPv6 traceroute	247
IPv6 management commands	247
Configuring Spanning Tree Protocol (STP) Related Features	249
STP overview	249
Configuring standard STP parameters	250
STP parameters and defaults	250
Enabling or disabling the Spanning Tree Protocol (STP)	251
Changing STP bridge and port parameters	252
STP protection enhancement	254
Displaying STP information	256
Configuring STP related features	265
Fast port span	265
Fast Uplink Span	267
802.1W Rapid Spanning Tree (RSTP)	269
802.1W Draft 3	307
Single Spanning Tree (SSTP)	311
STP per VLAN group	313
PVST/PVST+ compatibility	317
Overview of PVST and PVST+	318
VLAN tags and dual mode	319
Configuring PVST+ support	320
Displaying PVST+ support information	320
Configuration examples	321
PVRST compatibility	324
BPDU guard	324
Enabling BPDU protection by port	324
Re-enabling ports disabled by BPDU guard	325
Displaying the BPDU guard status	325
Example console messages	326
Root guard	326
Enabling STP root guard	327
Displaying the STP root guard	327
Displaying the root guard by VLAN	327
Error disable recovery	328
Enabling error disable recovery	328
Setting the recovery interval	328
Displaying the error disable recovery state by interface	329
Displaying the recovery state for all conditions	329
Displaying the recovery state by port number and cause	329
Errdisable Syslog messages	330
802.1s Multiple Spanning Tree Protocol	330
Multiple spanning-tree regions	330
Configuration notes	332
Configuring MSTP mode and scope	332
Reduced occurrences of MSTP reconvergence	333
Configuring additional MSTP parameters	335
Configuring Basic Layer 2 Features	347
About port regions	348
PowerConnect B-Series FCX device port regions	348
Enabling or disabling the Spanning Tree Protocol (STP)	348
Modifying STP bridge and port parameters	349
MAC learning rate control	349
Changing the MAC age time and disabling MAC address learning	349
Disabling the automatic learning of MAC addresses	350
Displaying the MAC address table	350
Configuring static MAC entries	350
Multi-port static MAC address	351
Configuring VLAN-based static MAC entries	352
Clearing MAC address entries	352
Flow-based MAC address learning	353
Feature overview	353
The benefits of flow-based learning	353
How flow-based learning works	354
Configuration considerations	354
Configuring flow-based MAC address learning	355
Displaying information about flow-based MACs	356
Clearing flow-based MAC address entries	356
Enabling port-based VLANs	356
Assigning IEEE 802.1Q tagging to a port	357
Defining MAC address filters	358
Configuration notes and limitations	358
Command syntax	358
Enabling logging of management traffic permitted by MAC address filters	360
MAC address filter override for 802.1X-enabled ports	361
Locking a port to restrict addresses	362
Configuration notes	362
Command syntax	362
Displaying and modifying system parameter default settings	363
Configuration considerations	363
Displaying system parameter default values	363
Modifying system parameter default values	367
TDynamic Buffer Allocation for an IronStack	368
Generic buffer profiles on PowerConnect Stackable devices	371
Remote Fault Notification (RFN) on 1G fiber connections	371
Enabling and disabling remote fault notification	372
Link Fault Signaling (LFS) for 10G	372
Jumbo frame support	373
Configuring Metro Features	375
Topology groups	375
Master VLAN and member VLANs	376
Control ports and free ports	376
Configuration considerations	376
Configuring a topology group	377
Displaying topology group information	378
Metro Ring Protocol (MRP)	379
Configuration notes	381
MRP rings without shared interfaces (MRP Phase 1)	381
MRP rings with shared interfaces (MRP Phase 2)	382
Ring initialization	383
How ring breaks are detected and healed	388
Master VLANs and customer VLANs	390
Configuring MRP	391
Using MRP diagnostics	394
Displaying MRP information	395
MRP CLI example	397
Virtual Switch Redundancy Protocol (VSRP)	399
Configuration notes and feature limitations	400
Layer 2 and Layer 3 redundancy	401
Master election and failover	401
VSRP-Aware security features	406
VSRP parameters	406
Configuring basic VSRP parameters	409
Configuring optional VSRP parameters	410
Displaying VSRP information	418
VSRP fast start	421
VSRP and MRP signaling	422
Configuring Uni-Directional Link Detection (UDLD) and Protected Link Groups	425
UDLD overview	425
UDLD for tagged ports	426
Configuration notes and feature limitations	426
Enabling UDLD	427
Enabling UDLD for tagged ports	427
Changing the Keepalive interval	427
Changing the Keepalive retries	428
Displaying UDLD information	428
Clearing UDLD statistics	430
Protected link groups	430
About active ports	431
Using UDLD with protected link groups	431
Configuration notes	431
Creating a protected link group and assigning an active port	432
Configuring Trunk Groups and Dynamic Link Aggregation	435
Trunk group overview	435
Trunk group connectivity to a server	436
Trunk group rules	437
Trunk group configuration examples	438
Support for flexible trunk group membership	440
Trunk group load sharing	440
Configuring a trunk group	442
CLI syntax for configuring consecutive ports in a trunk group	442
CLI syntax for configuring non-consecutive ports in a trunk group	443
Example 1: Configuring the trunk groups shown in Figure 78	443
Example 2: Configuring a trunk group that spans two Gbps Ethernet modules in a chassis device	444
Example 3: Configuring a multi-slot trunk group with one port per module	445
Example 4: Configuring a trunk group of 10 Gbps Ethernet ports	445
Additional trunking options	446
Displaying trunk group configuration information	450
Viewing the first and last ports in a trunk group	451
Dynamic link aggregation	452
IronStack LACP trunk group configuration example	453
Examples of valid LACP trunk groups	453
Configuration notes and limitations	454
Adaptation to trunk disappearance	455
Flexible trunk eligibility	455
Enabling dynamic link aggregation	456
How changing the VLAN membership of a port affects trunk groups and dynamic keys	458
Additional trunking options for LACP trunk ports	458
Link aggregation parameters	458
Displaying and determining the status of aggregate links	463
Events that affect the status of ports in an aggregate link	464
Displaying link aggregation and port status information	464
Displaying LACP status information	466
Clearing the negotiated aggregate links table	467
Configuring single link LACP	467
Configuration notes	467
CLI syntax	467
Configuring Virtual LANs (VLANs)	469
VLAN overview	469
Types of VLANs	469
Default VLAN	475
802.1Q tagging	476
Spanning Tree Protocol (STP)	479
Virtual routing interfaces	479
VLAN and virtual routing interface groups	481
Dynamic, static, and excluded port membership	481
Super aggregated VLANs	483
Trunk group ports and VLAN membership	483
Summary of VLAN configuration rules	484
Routing between VLANs	485
Virtual routing interfaces (Layer 3 Switches only)	485
Routing between VLANs using virtual routing interfaces (Layer 3 Switches only)	485
Dynamic port assignment (Layer 2 Switches and Layer 3 Switches)	486
Assigning a different VLAN ID to the default VLAN	486
Assigning different VLAN IDs to reserved VLANs 4091 and 4092	487
Assigning trunk group ports	488
Configuring port-based VLANs	488
Modifying a port-based VLAN	492
Enable spanning tree on a VLAN	493
Configuring IP subnet, IPX network and protocol-based VLANs	494
Configuration example	494
Configuring IP subnet, IPX network, and protocol-based VLANs within port-based VLANs	496
Configuring an IPv6 protocol VLAN	500
Routing between VLANs using virtual routing interfaces (Layer 3 Switches only)	500
Configuring protocol VLANs with dynamic ports	506
Aging of dynamic ports	507
Configuration guidelines	508
Configuring an IP, IPX, or AppleTalk Protocol VLAN with Dynamic Ports	508
Configuring an IP subnet VLAN with dynamic ports	508
Configuring an IPX network VLAN with dynamic ports	509
Configuring uplink ports within a port-based VLAN	510
Configuration considerations	510
Configuration syntax	510
Configuring the same IP subnet address on multiple port-based VLANs	511
Configuring VLAN groups and virtual routing interface groups	514
Configuring a VLAN group	514
Configuring a virtual routing interface group	516
Displaying the VLAN group and virtual routing interface group information	517
Allocating memory for more VLANs or virtual routing interfaces	518
Configuring super aggregated VLANs	519
Configuration notes	522
Configuring aggregated VLANs	522
Verifying the configuration	523
Complete CLI examples	523
Configuring 802.1Q-in-Q tagging	526
Configuration rules	527
Enabling 802.1Q-in-Q tagging	527
Example configuration	529
Configuring 802.1Q-in-Q tag profiles	530
Configuring private VLANs	530
Configuration notes	533
Enabling broadcast or unknown unicast traffic to the PVLAN	537
CLI example for a general PVLAN network	538
CLI example for a PVLAN network with switch-switch link ports	538
Dual-mode VLAN ports	539
Displaying VLAN information	542
Displaying VLANs in alphanumeric order	542
Displaying system-wide VLAN information	543
Displaying global VLAN information	544
Displaying VLAN information for specific ports	544
Displaying a port VLAN membership	545
Displaying a port dual-mode VLAN membership	545
Displaying port default VLAN IDs (PVIDs)	545
Displaying PVLAN information	546
Configuring GARP VLAN Registration Protocol (GVRP)	547
GVRP overview	547
Application examples	548
Dynamic core and fixed edge	548
Dynamic core and dynamic edge	549
Fixed core and dynamic edge	550
Fixed core and fixed edge	550
VLAN names	550
Configuration notes	550
Configuring GVRP	552
Changing the GVRP base VLAN ID	552
Increasing the maximum configurable value of the Leaveall timer	552
Enabling GVRP	553
Disabling VLAN advertising	553
Disabling VLAN learning	554
Changing the GVRP timers	554
Converting a VLAN created by GVRP into a statically-configured VLAN	556
Displaying GVRP information	556
Displaying GVRP configuration information	557
Displaying GVRP VLAN information	559
Displaying GVRP statistics	561
Displaying CPU utilization statistics	562
Displaying GVRP diagnostic information	564
Clearing GVRP statistics	564
CLI examples	564
Dynamic core and fixed edge	565
Dynamic core and dynamic edge	566
Fixed core and dynamic edge	566
Fixed core and fixed edge	567
Configuring MAC-based VLANs	569
Overview	569
Static and dynamic hosts	569
MAC-based VLAN feature structure	569
Dynamic MAC-based VLAN	570
Configuration notes and feature limitations	571
Configuration example	572
Configuring MAC-based VLANs	573
Using MAC-based VLANs and 802.1X security on the same port	573
Configuring generic and Dell vendor-specific attributes on the RADIUS server	574
Aging for MAC-based VLAN	575
Disabling aging for MAC-based VLAN sessions	576
Configuring the maximum MAC addresses per port	577
Configuring a MAC-based VLAN for a static host	577
Configuring MAC-based VLAN for a dynamic host	578
Configuring dynamic MAC-based VLAN	578
Configuring MAC-based VLANs using SNMP	579
Displaying Information about MAC-based VLANs	579
Displaying the MAC-VLAN table	579
Displaying the MAC-VLAN table for a specific MAC address	579
Displaying allowed MAC addresses	580
Displaying denied MAC addresses	580
Displaying detailed MAC-VLAN data	581
Displaying MAC-VLAN information for a specific interface	583
Displaying MAC addresses in a MAC-based VLAN	584
Displaying MAC-based VLAN logging	585

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384
1,385
1,386
1,387
1,388
1,389
1,390
1,391
1,392
1,393
1,394
1,395
1,396
1,397
1,398
1,399
1,400
1,401
1,402
1,403
1,404
1,405
1,406
1,407
1,408
1,409
1,410
1,411
1,412
1,413
1,414
1,415
1,416
1,417
1,418
1,419
1,420
1,421
1,422
1,423
1,424
1,425
1,426
1,427
1,428
1,429
1,430
1,431
1,432
1,433
1,434
1,435
1,436
1,437
1,438
1,439
1,440
1,441
1,442
1,443
1,444
1,445
1,446
1,447
1,448
1,449
1,450
1,451
1,452
1,453
1,454
1,455
1,456
1,457
1,458
1,459
1,460
1,461
1,462
1,463
1,464
1,465
1,466
1,467
1,468
1,469
1,470
1,471
1,472
1,473
1,474
1,475
1,476
1,477
1,478
1,479
1,480
1,481
1,482
1,483
1,484
1,485
1,486
1,487
1,488
1,489
1,490
1,491
1,492
1,493
1,494

Match case Limit results 1 per page

576

PowerConnect B-Series FCX Configuration Guide

53-1002266-01

Using ACLs to filter ARP packets

Specify the

<port>

variable in the following formats:

•

PowerConnect B-Series FCX stackable switches –

<stack-unit/slotnum/portnum>

Using ACLs to filter ARP packets

You can use ACLs to filter ARP packets. Without this feature, ACLs cannot be used to permit or deny

incoming

ARP packets. Although an ARP packet contains an IP address just as an IP packet does,

an ARP packet is not an IP packet; therefore, it is not subject to normal filtering provided by ACLs.

When a Dell PowerConnect device receives an ARP request, the source MAC and IP addresses are

stored in the device ARP table. A new record in the ARP table overwrites existing records that

contain the same IP address. This behavior can cause a condition called "ARP hijacking", when two

hosts with the same IP address try to send an ARP request to the device.

Normally ARP hijacking is not a problem because IP assignments are done dynamically; however, in

some cases, ARP hijacking can occur, such as when a configuration allows a router interface to

share the IP address of another router interface. Since multiple VLANs and the router interfaces

that are associated with each of the VLANs share the same IP segment, it is possible for two hosts

in two different VLANs to fight for the same IP address in that segment. ARP filtering using ACLs

protects an IP host record in the ARP table from being overwritten by a hijacking host. Using ACLs to

filter ARP requests checks the source IP address in the received ARP packet. Only packets with the

permitted IP address will be allowed to be to be written in the ARP table; others are dropped.

Configuration considerations

•

This feature is available on devices running Layer 3 code. This filtering occurs on the

management processor.

•

The feature is available on physical interfaces and virtual routing interfaces. It is supported on

the following physical interface types Ethernet and trunks.

•

ACLs used to filter ARP packets on a virtual routing interface can be inherited from a previous

interface if the virtual routing interface is defined as a follower virtual routing interface.

Configuring ACLs for ARP filtering

To implement the ACL ARP filtering feature, enter commands such as the following.

PowerConnect(config)# access-list 101 permit ip host 192.168.2.2 any

PowerConnect(config)# access-list 102 permit ip host 192.168.2.3 any

PowerConnect(config)# access-list 103 permit ip host 192.168.2.4 any

PowerConnect(config)# vlan 2

PowerConnect(config-vlan-2)# tag ethe 1/1 to 1/2

PowerConnect(config-vlan-2)# router-interface ve 2

PowerConnect(config-vlan-2)# vlan 3

PowerConnect(config-vlan-3)# tag ethe 1/1 to 1/2

PowerConnect(config-vlan-3)#router-int ve 3

PowerConnect(config-vlan-3)# vlan 4

PowerConnect(config-vlan-4)# tag ethe 1/1 to 1/2

PowerConnect(config-vlan-4)# router-int ve 4

PowerConnect(config-vlan-4)# interface ve 2

PowerConnect(config-ve-2)# ip access-group 101 in

PowerConnect(config-ve-2)# ip address 192.168.2.1/24

PowerConnect(config-ve-2)# ip use-ACL-on-arp 103