Cisco Catalyst 3560-X Software Configuration Manual page 691

Chapter 1 Configuring Dynamic ARP Inspection
Configuring ARP ACLs for Non-DHCP Environments
This procedure shows how to configure dynamic ARP inspection when Switch B shown in
on page 1-3
If you configure port 1 on Switch A as trusted, a security hole is created because both Switch A and
Host 1 could be attacked by either Switch B or Host 2. To prevent this possibility, you must configure
port 1 on Switch A as untrusted. To permit ARP packets from Host 2, you must set up an ARP ACL and
apply it to VLAN 1. If the IP address of Host 2 is not static (it is impossible to apply the ACL
configuration on Switch A) you must separate Switch A from Switch B at Layer 3 and use a router to
route packets between them.
Beginning in privileged EXEC mode, follow these steps to configure an ARP ACL on Switch A. This
procedure is required in non-DHCP environments.
Command
Step 1 configure terminal
Step 2
arp access-list acl-name
Step 3 permit ip host sender-ip mac host
sender-mac [log]
Step 4 exit
Step 5
ip arp inspection filter arp-acl-name vlan
vlan-range [static]
OL-25303-03
does not support dynamic ARP inspection or DHCP snooping.
Purpose
Enter global configuration mode.
Define an ARP ACL, and enter ARP access-list configuration mode. By
default, no ARP access lists are defined.
Note
Permit ARP packets from the specified host (Host 2).
• For sender-ip, enter the IP address of Host 2.
• For sender-mac, enter the MAC address of Host 2.
• (Optional) Specify log to log a packet in the log buffer when it
matches the access control entry (ACE). Matches are logged if you
also configure the matchlog keyword in the ip arp inspection vlan
logging global configuration command. For more information, see
the
Return to global configuration mode.
Apply the ARP ACL to the VLAN. By default, no defined ARP ACLs
are applied to any VLAN.
For arp-acl-name, specify the name of the ACL created in Step 2.
•
For vlan-range, specify the VLAN that the switches and hosts are
•
in. You can specify a single VLAN identified by VLAN ID number,
a range of VLANs separated by a hyphen, or a series of VLANs
separated by a comma. The range is 1 to 4094.
(Optional) Specify static to treat implicit denies in the ARP ACL
•
as explicit denies and to drop packets that do not match any
previous clauses in the ACL. DHCP bindings are not used.
If you do not specify this keyword, it means that there is no explicit
deny in the ACL that denies the packet, and DHCP bindings
determine whether a packet is permitted or denied if the packet
does not match any clauses in the ACL.
ARP packets containing only IP-to-MAC address bindings are
compared against the ACL. Packets are permitted only if the access list
permits them.
At the end of the ARP access list, there is an implicit deny ip
any mac any command.
"Configuring the Log Buffer" section on page
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
Configuring Dynamic ARP Inspection
Figure 1-2
1-13.
1-9