32-12
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter32 Understanding and Configuring Dynamic ARP Inspection
Configuring Dynamic ARP Inspection
To remove the ARP ACL, use the no arp access-list global configuration command. To remove the ARP
ACL attached to a VLAN, use the no ip arp inspection filter arp-acl-name vlan vlan-range global
configuration command.
This example shows how to configure an ARP ACL called host2 on Switch A, to permit ARP packets
from HostB (IP address 170.1.1.2 and MAC address 2.2.2), to apply the ACL to VL AN 100, and to
configure port 1 on Switch A as untrusted:
SwitchA# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
SwitchA(config)# arp access-list hostB
SwitchA(config-arp-nacl)# permit ip host 170.1.1.2 mac host 2.2.2 log
SwitchA(config-arp-nacl)# exit
SwitchA(config)# ip arp inspection filter hostB vlan 100 static
SwitchA(config)# interface g3/48
SwitchA(config-if)# no ip arp inspection trust
SwitchA(config-if)# end
SwitchA# show arp access-list hostB
ARP access list hostB
permit ip host 170.1.1.2 mac host 0002.0002.0002 log
SwitchA# show ip arp inspection interfaces
Interface Trust State Rate (pps) Burst Interval
--------------- ----------- ---------- --------------
Gi1/1 Untrusted 15 1
Gi1/2 Untrusted 15 1
Gi3/1 Untrusted 15 1
Gi3/2 Untrusted 15 1
Gi3/3 Untrusted 15 1
Step7 Switch(config-if)# no ip arp inspection trust Configures the Switch A interface that is connected to
Switch B as untrusted.
By default, all interfaces are untrusted.
For untrusted interfaces, the switch intercepts all
ARP requests and responses. It verifies that the
intercepted packets have valid IP-to-MAC address
bindings before updating the local cache and before
forwarding the packet to the appropriate destination.
The switch drops invalid packets and logs them in the
log buffer according to the logging configuration
specified with the ip arp inspection vlan logging
global configuration command. For more
information, see the “Configuring the Log Buffer”
section on page32-14.
Step8 Switch(config-if)# end Returns to privileged EXEC mode.
Step9 Switch# show arp access-list [
acl-name
]
Switch# show ip arp inspection vlan
vlan-range
Switch# show ip arp inspection interfaces
Verifies the dynamic ARP inspection configuration.
Step10 Switch# copy running-config startup-config (Optional) Saves your entries in the configuration
file.
Command Purpose