Netgear XCM8810 Chassis Hardware Installation Guide - Page 629

NETGEAR 8800 Chassis Switch CLI Manual vlan_name all ports drop-packet block-port permanently duration_in_seconds snmp-trap Specifies the name of the VLAN to which this rule applies. Specifies all ports to participate in ARP validation. Specifies one or more ports to participate in ARP validation. Specifies that the switch drops the invalid ARP packet. Indicates that the switch blocks invalid ARP requests on the specified port. Specifies the switch to permanently disable the port upon receiving an invalid ARP request. Specifies the switch to temporarily disable the specified port upon receiving an invalid ARP request. The range is seconds. Specifies the switch to send an SNMP trap when an event occurs. Default By default, ARP validation is disabled. Usage Guidelines The violation action setting determines what action(s) the switch takes when an invalid ARP is received. Depending on your configuration, the switch uses the following methods to check the validity of incoming ARP packets: • Drop packet-The switch confirms that the MAC address and its corresponding IP address are in the DHCP binding database built by DHCP snooping. This is the default behavior when you enable ARP validation. If the MAC address and its corresponding IP address are in the DHCP bindings database, the entry is valid. If the MAC address and its corresponding IP address are not in the DHCP bindings database, the entry is invalid, and the switch drops the ARP packet. • IP address-The switch checks the IP address in the ARP payload. If the switch receives an IP address in the ARP payload that is in the DHCP binding database, the entry is valid. If the switch receives an IP address that is not in the DHCP binding database, for example 255.255.255.255 or an IP multicast address, the entry is invalid or unexpected. • Source MAC address-The switch checks ARP requests and responses for the source MAC address in the Ethernet header and the sender's host address in the ARP payload. If the source MAC address and senders's host address are the same, the entry is valid. If the source MAC source and the sender's host address are different, the entry is invalid. • Destination MAC address-The switch checks the ARP payload for the destination MAC address in the Ethernet header and the receiver's host address. If the destination MAC address and the target's host address are the same, the entry is valid. If the destination MAC address and the target's host address are different, the entry is invalid. Any violation that occurs causes the switch to generate an Event Management System (EMS) log message. You can configure to suppress the log messages by configuring EMS Chapter 15. Security Commands | 629