DGS-6604 ip arp inspection validateCLI Reference Guide 228ip arp inspection validateUse the command to specify the additional checks to be performed during ARPinspection check. Use the no form of the command to remove specific additionalcheck.ip arp inspection validate {[src-mac] [dst-mac] [ip]}no ip arp inspection validate [src-mac] [dst-mac] [ip]Default DisabledCommand Mode Global configuration modeUsage Guideline Use the command to specify the additional checks to be performed duringdynamic ARP inspection check. The specified check will be performed onpackets arriving at the untrusted interface and belong to the VLANs that areenabled for ip arp inspection.Use the no form of the command with specific option to disabled specific type ofcheck.Example This example shows how to enable source MAC validation:This example shows how to disable source MAC validation:Syntax Descriptionsrc-mac (Optional) Specify to check, for both ARP request response packets, theconsistency of the source MAC address in the Ethernet header against thesender MAC address in the ARP payload.dst-mac (Optional) Specify to check, for ARP response packets, the consistency of thedestination MAC address in the Ethernet header against the target MAC addressin the ARP payload.ip (Optional) Checks the ARP body for invalid and unexpected IP addresses.Specify to check the validity of IP address in the ARP payload. Sender IP in bothARP request and response and target IP in ARP response are validated.Packets with addresses including 0.0.0.0,255.255.255.255, and all IP multicast addresses are dropped. Sender IPaddresses are checked in all ARPrequests and responses, and target IP addresses are checked only in ARPresponses.Switch# configure terminalSwitch(config)# ip arp inspection validate src-macSwitch(config)#
