Filter
Top Products
PowerConnect B-Series FCX Configuration Guide 577
53-1002266-01
Using ACLs to filter ARP packets
16
PowerConnect(config-ve-2)# exit
PowerConnect(config)# interface ve 3
PowerConnect(config-ve-3)# ip access-group 102 in
PowerConnect(config-ve-3)# ip follow ve 2
PowerConnect(config-ve-3)# ip use-ACL-on-arp
PowerConnect(config-ve-3)# exit
PowerConnect(config-vlan-4)# interface ve 4
PowerConnect(config-ve-4)# ip follow ve 2
PowerConnect(config-ve-4)# ip use-ACL-on-arp
PowerConnect(config-ve-4)# exit
Syntax: [no] ip use-ACL-on-arp [ <access-list-number> ]
When the use-ACL-on-arp command is configured, the ARP module checks the source IP address of
the ARP request packets received on the interface. It then applies the specified ACL policies to the
packet. Only the packet with the IP address that the ACL permits will be allowed to be to be written
in the ARP table; those that are not permitted will be dropped.
The <access-list-number> parameter identifies the ID of the standard ACL that will be used to filter
the packet. Only the source and destination IP addresses will be used to filter the ARP packet. You
can do one of the following for <access-list-number>:
• Enter an ACL ID to explicitly specify the ACL to be used for filtering. In the example above, the
line PowerConnect(config-ve-2)# ip use-ACL-on-arp 103 specifies ACL 103 to
be used as the filter.
• Allow the ACL ID to be inherited from the IP ACLs that have been defined for the device. In the
example above, the line PowerConnect(config-ve-4)# ip use-ACL-on-arp allows
the ACL to be inherited from IP ACL 101 because of the ip follow relationship between virtual
routing interface 2 and virtual routing interface 4. Virtual routing interface 2 is configured with
IP ACL 101; thus virtual routing interface 4 inherits IP ACL 101.
ARP requests will not be filtered by ACLs if one of the following conditions occur:
• If the ACL is to be inherited from an IP ACL, but there is no IP ACL defined.
• An ACL ID is specified for the use-ACL-on-arp command, but no IP address or “any any” filtering
criteria have been defined under the ACL ID.
Displaying ACL filters for ARP
To determine which ACLs have been configured to filter ARP requests, enter a command such as
the following.
PowerConnect(config)# show ACL-on-arp
Port ACL ID Filter Count
2 103 10
3 102 23
4 101 12
Syntax: show ACL-on-arp [ethernet <port> | loopback [ <num> ] | ve [ <num> ] ]
Specify the <port> variable in the following formats:
• PowerConnect B-Series FCX stackable switches – <stack-unit/slotnum/portnum>
If the <port> variable is not specified, all ports on the device that use ACLs for ARP filtering will be
included in the display.
The Filter Count column shows how many ARP packets have been dropped on the interface since
the last time the count was cleared.