arp access-list

Creates an Address Resolution Protocol (ARP) access control list (ACL), which is one of the steps implementing Dynamic ARP Inspection (DAI) on a VLAN.

Syntax

arp access-list acl-name

no arp access-list acl-name

Command Default

No ARP ACLs are defined.

Parameters

acl-name: Specifies the name of the ARP ACL. The name can be up to 63 characters in length, and must begin with an alphanumeric character. No special characters are allowed, except for the underscore (_) and hyphen (-).

Modes

Global configuration mode

Interface subtype configuration mode

Usage Guidelines

On untrusted interfaces of DAI-enabled VLANs, incoming ARP packets from permitted IP/MAC addresses are accepted only if all of the following steps were performed:

Create the ACL, using the arp access-list command.
In the ACL, create one or more rules, using the permit ip host command. Each rule specifies an IP/MAC address-pair.
Apply the ACL to one or more VLANs, using the ip arp inspection filter command.
Enable DAI on such VLANs, using the ip arp inspection command.

You can also append the permit ip host command to the arp access-list command.

You also need ARP ACLs to implement ARP Guard on a physical or port-channel interface.

The no form of the command deletes the ARP ACL if the ACL is not applied on any VLAN or port.

Examples

The following example creates an ARP ACL named "host2" and then defines one permit rule in that ACL.

device# configure terminal
device(config)# arp access-list host2
device(config-arp-acl)# permit ip host 1.1.1.1 mac host 0000.0011.0022

The following example creates an ARP ACL, creates permit ip host rules within, applies it to a VLAN, and enables Dynamic ARP Inspection (DAI) on the VLAN.

device# configure terminal
device(config)# arp access-list arp_acl_1
device(config-arp-acl)# permit ip host 1.1.1.1 mac host 0020.2222.2222
device(config-arp-acl)# permit ip host 1.1.1.2 mac host 0020.2222.2223
device(config-arp-acl)# exit

device(config)# vlan 200
device(config-vlan-200)# ip arp inspection filter arp_acl_1
device(conf-vlan-200)# ip arp inspection

The following example creates an ARP ACL, creates permit ip host rules within, and applies it to an interface. This is the first stage of ARP Guard implementation.

device# configure terminal
device(config)# arp access-list arp_acl_2
device(config-arp-acl)# permit ip host 1.1.1.1 mac host 0020.2222.2222
device(config-arp-acl)# permit ip host 1.1.1.2 mac host 0020.2222.2223
device(config-arp-acl)# exit

device(config)# interface ethernet 1/2
device(conf-if-eth-1/2)# switchport
device(conf-if-eth-1/2)# ip arp inspection filter arp_acl_2

Note

At this point in the flow, ARP Guard is not yet enabled. For enablement details, refer to the "ARP Guard" section of the Extreme SLX-OS Layer 3 Routing Configuration Guide.