Configuring Dynamic Arp Inspection In Dhcp Environments - Cisco Catalyst 2960-XR Security Configuration Manual

Configuring Dynamic ARP Inspection
This example shows how to configure an ARP ACL called host2 on Switch A, to permit ARP packets from
Host 2 (IP address 1.1.1.1 and MAC address 0001.0001.0001), to apply the ACL to VLAN 1, and to configure
port 1 on Switch A as untrusted:
Switch(config)#arp access-list host2
Switch(config-arp-acl)#permit ip host 1.1.1.1 mac host 1.1.1
Switch(config-arp-acl)# exit
Switch(config)# ip arp inspection filter host2 vlan 1
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# no ip arp inspection trust

Configuring Dynamic ARP Inspection in DHCP Environments

Before You Begin
This procedure shows how to configure dynamic ARP inspection when two switches support this feature.
Host 1 is connected to Switch A, and Host 2 is connected to Switch B. Both switches are running dynamic
ARP inspection on VLAN 1 where the hosts are located. A DHCP server is connected to Switch A. Both hosts
acquire their IP addresses from the same DHCP server. Therefore, Switch A has the bindings for Host 1 and
Host 2, and Switch B has the binding for Host 2.
Dynamic ARP inspection depends on the entries in the DHCP snooping binding database to verify
Note
IP-to-MAC address bindings in incoming ARP requests and ARP responses. Make sure to enable DHCP
snooping to permit ARP packets that have dynamically assigned IP addresses.
Beginning in privileged EXEC mode, follow these steps to configure dynamic ARP inspection. You must
perform this procedure on both switches. This procedure is required.
SUMMARY STEPS
1. show cdp neighbors
2. configure terminal
3. ip arp inspection vlan vlan-range
4. Interfaceinterface-id
5. ip arp inspection trust
6. end
7. show ip arp inspection interfacesshow ip arp inspection vlan vlan-range
8. show ip dhcp snooping binding
9. show ip arp inspection statistics vlan vlan-range
10. copy running-config startup-config
DETAILED STEPS
Command or Action
Step 1 show cdp neighbors
OL-29434-01
Configuring Dynamic ARP Inspection in DHCP Environments
Purpose
Verify the connection between the switches.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
205