D-Link DGS-3130 Emulator - Page 326

DGS-3130 Layer 3 Stackable Managed Switch CLI Reference Guide Usage Guideline When an interface is in the trust state, the ARP packets arriving at the interface will not be inspected. When an interface is in the untrusted state, ARP packets arriving at the port and belongs to the VLAN that is enabled for inspection will be inspected. Example This example shows how to configure port 1/0/3 to be trusted for DAI. Switch# configure terminal Switch(config)# interface ethernet 1/0/3 Switch(config-if)# ip arp inspection trust Switch(config-if)# 30-8 ip arp inspection validate This command is used to specify the additional checks to be performed during an ARP inspection check. Use the no form of this command to remove specific additional check. ip arp inspection validate [src-mac] [dst-mac] [ip] no ip arp inspection validate [src-mac] [dst-mac] [ip] Parameters src-mac dst-mac ip (Optional) Specifies to check for ARP requests and response packets and the consistency of the source MAC address in the Ethernet header against the sender MAC address in the ARP payload. (Optional) Specifies to check for ARP response packets and the consistency of the destination MAC address in the Ethernet header against the target MAC address in the ARP payload. (Optional) Specifies to check the ARP body for invalid and unexpected IP addresses. Specifies to check the validity of IP address in the ARP payload. The sender IP in both the ARP request and response and target IP in the ARP response are validated. Packets destined for the IP addresses 0.0.0.0, 255.255.255.255, and all IP multicast addresses are dropped. Sender IP addresses are checked in all ARP requests and responses, and target IP addresses are checked only in ARP responses. Default By default, this option is disabled. Command Mode Global Configuration Mode. Command Default Level Level: 12. Usage Guideline Use this command to specify the additional checks to be performed during the dynamic ARP inspection check. The specified check will be performed on packets arriving at the untrusted interface and belong to the VLANs that are enabled for IP ARP inspection. If no parameters are specified, all options are enabled or disabled. Use the no form of the command with the specific option to disable the specific type of check. 322