19-7
Cisco ME 3400 EthernetAccess Switch SoftwareConfiguration Guide
78-17058-01
Chapter19 Configuring Dynamic A RP In spection Configuring Dynamic ARP Inspection
Configuring Dynamic ARP Inspection in DHCP Environments
This procedure shows how to configure dynamic ARP inspection when two switches support this feature.
Host 1 is connected to Switch A, and Host 2 is connected to Switch B as shown in Figure19-2 on
page 19-3. Both switches are running dynamic ARP inspection on VLAN 1 where the hosts are loca ted.
A DHCP server is connected to Switch A. Both hosts acquire their IP addresses from the same DHCP
server. Therefore, Switch A has the bindings for Host 1 and Host 2, and Switch B has the binding for
Host 2.
Note Dynamic ARP inspection depends on the entries in the DH CP sn oopin g b inding da ta base to verif y
IP-to-MAC address bindings in incoming ARP requests and ARP responses. Make sure to e nable DHCP
snooping to permit ARP packets that have dynamically assigned IP addresses. For configur ation
information, see Chapter 18, “Configuring DHCP Features and IP Source Guard.”
For information on how to configure dynamic ARP inspection when only one sw itch sup ports the
feature, see the “Configuring ARP ACLs for Non-DHCP Environments” section on page 19-8.
Beginning in privileged EXEC mode, follow these steps to configure dynamic ARP inspection. You must
perform this procedure on both switches. This procedure is required.
Command Purpose
Step1 show cdp neighbors Verify the connection between the switches.
Step2 configure terminal Enter global configuration mode.
Step3 ip arp inspection vlan vlan-range Enable dynamic ARP inspection on a per-VLAN basis. By
default, dynamic ARP inspection is disabled on all VLANs.
For vlan-range, specify a single VLAN identified by VL AN I D
number, a range of VLANs separated by a hyphen, or a series of
VLANs separated by a comma. The range is 1 to 4094.
Specify the same VLAN ID for both switches.
Step4 interface interface-id Specify the interface connected to the other switch, and enter
interface configuration mode.
Step5 no shutdown Enable the port, if necessary. By default, UNIs are d isabl ed, an d
NNIs are enabled.
Step6 ip arp inspection trust Configure the connection between the switches as trusted.
By default, all interfaces are untrusted.
The switch does not check ARP packets that it receives from the
other switch on the trusted interface. It simply forwards the
packets.
For untrusted interfaces, the switch intercepts all ARP requests
and responses. It verifies that the intercepted packets have valid
IP-to-MAC address bindings before updating the local cache and
before forwarding the packet to the appropriate destination. Th e
switch drops invalid packets and logs them in the log buffer
according to the logging configuration specified with the ip arp
inspection vlan logging global configuration command. For
more information, see the “Configuring the Log Buffer” section
on page 19-13.