Cisco Catalyst 2960 Software Configuration Manual page 556

Configuring Dynamic ARP Inspection
Beginning in privileged EXEC mode, follow these steps to configure dynamic ARP inspection. You must
perform this procedure on both switches. This procedure is required.
Command
Step 1 show cdp neighbors
Step 2
configure terminal
Step 3
ip arp inspection vlan vlan-range
Step 4
interface interface-id
Step 5
ip arp inspection trust
Step 6 end
Step 7
show ip arp inspection interfaces
show ip arp inspection vlan vlan-range
Step 8 show ip dhcp snooping binding
Step 9 show ip arp inspection statistics vlan
vlan-range
Step 10 copy running-config startup-config
To disable dynamic ARP inspection, use the no ip arp inspection vlan vlan-range global configuration
command. To return the interfaces to an untrusted state, use the no ip arp inspection trust interface
configuration command.
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
22-8
Chapter 22
Purpose
Verify the connection between the switches.
Enter global configuration mode.
Enable dynamic ARP inspection on a per-VLAN basis. By
default, dynamic ARP inspection is disabled on all VLANs.
For vlan-range, specify a single VLAN identified by VLAN ID
number, a range of VLANs separated by a hyphen, or a series of
VLANs separated by a comma. The range is 1 to 4094.
Specify the same VLAN ID for both switches.
Specify the interface connected to the other switch, and enter
interface configuration mode.
Configure the connection between the switches as trusted.
By default, all interfaces are untrusted.
The switch does not check ARP packets that it receives from the
other switch on the trusted interface. It simply forwards the
packets.
For untrusted interfaces, the switch intercepts all ARP requests
and responses. It verifies that the intercepted packets have valid
IP-to-MAC address bindings before updating the local cache and
before forwarding the packet to the appropriate destination. The
switch drops invalid packets and logs them in the log buffer
according to the logging configuration specified with the ip arp
inspection vlan logging global configuration command. For
more information, see the
on page 22-13.
Return to privileged EXEC mode.
Verify the dynamic ARP inspection configuration.
Verify the DHCP bindings.
Check the dynamic ARP inspection statistics.
(Optional) Save your entries in the configuration file.
Configuring Dynamic ARP Inspection
"Configuring the Log Buffer" section
OL-26520-01