Chapter 23 Configuring Dynamic ARP Inspection

Configuring Dynamic ARP Inspection

 

Command

Purpose

Step 4

 

 

interface interface-id

Specify the interface connected to the other switch, and enter

 

 

interface configuration mode.

Step 5

 

 

ip arp inspection trust

Configure the connection between the switches as trusted.

 

 

By default, all interfaces are untrusted.

 

 

The switch does not check ARP packets that it receives from the

 

 

other switch on the trusted interface. It simply forwards the

 

 

packets.

 

 

For untrusted interfaces, the switch intercepts all ARP requests

 

 

and responses. It verifies that the intercepted packets have valid

 

 

IP-to-MAC address bindings before updating the local cache and

 

 

before forwarding the packet to the appropriate destination. The

 

 

switch drops invalid packets and logs them in the log buffer

 

 

according to the logging configuration specified with the ip arp

 

 

inspection vlan logging global configuration command. For

 

 

more information, see the “Configuring the Log Buffer” section

 

 

on page 23-12.

Step 6

 

 

end

Return to privileged EXEC mode.

Step 7

 

 

show ip arp inspection interfaces

Verify the dynamic ARP inspection configuration.

 

show ip arp inspection vlan vlan-range

 

Step 8

 

 

show ip dhcp snooping binding

Verify the DHCP bindings.

Step 9

 

 

show ip arp inspection statistics vlan

Check the dynamic ARP inspection statistics.

 

vlan-range

 

Step 10

 

 

copy running-config startup-config

(Optional) Save your entries in the configuration file.

 

 

 

To disable dynamic ARP inspection, use the no ip arp inspection vlan vlan-rangeglobal configuration command. To return the interfaces to an untrusted state, use the no ip arp inspection trust interface configuration command.

This example shows how to configure dynamic ARP inspection on Switch A in VLAN 1. You would perform a similar procedure on Switch B:

Switch(config)# ip arp inspection vlan 1

Switch(config)# interface gigabitethernet1/0/1

Switch(config-if)#ip arp inspection trust

Configuring ARP ACLs for Non-DHCP Environments

This procedure shows how to configure dynamic ARP inspection when Switch B shown in Figure 23-2 on page 23-3does not support dynamic ARP inspection or DHCP snooping.

If you configure port 1 on Switch A as trusted, a security hole is created because both Switch A and Host 1 could be attacked by either Switch B or Host 2. To prevent this possibility, you must configure port 1 on Switch A as untrusted. To permit ARP packets from Host 2, you must set up an ARP ACL and apply it to VLAN 1. If the IP address of Host 2 is not static (it is impossible to apply the ACL configuration on Switch A) you must separate Switch A from Switch B at Layer 3 and use a router to route packets between them.

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

23-8

OL-9775-02

 

 

Page 546
Image 546
Cisco Systems 3750E manual Configuring ARP ACLs for Non-DHCP Environments, 23-8