Restrictions For Dynamic Arp Inspection - Cisco Catalyst 2960-XR Security Configuration Manual

Configuring Dynamic ARP Inspection
Feature
Rate limit of incoming ARP packets
ARP ACLs for non-DHCP environments

Restrictions for Dynamic ARP Inspection

This section lists the restrictions and guidelines for configuring Dynamic ARP Inspection on the switch.
• Dynamic ARP inspection is an ingress security feature; it does not perform any egress checking.
• Dynamic ARP inspection is not effective for hosts connected to switches that do not support dynamic
• Dynamic ARP inspection depends on the entries in the DHCP snooping binding database to verify
• Dynamic ARP inspection is supported on access ports, trunk ports, EtherChannel ports, and private
• A physical port can join an EtherChannel port channel only when the trust state of the physical port and
• The rate limit is calculated separately on each switch in a switch stack. For a cross-stack EtherChannel,
OL-29434-01
ARP inspection or that do not have this feature enabled. Because man-in-the-middle attacks are limited
to a single Layer 2 broadcast domain, separate the domain with dynamic ARP inspection checks from
the one with no checking. This action secures the ARP caches of hosts in the domain enabled for dynamic
ARP inspection.
IP-to-MAC address bindings in incoming ARP requests and ARP responses. Make sure to enable DHCP
snooping to permit ARP packets that have dynamically assigned IP addresses.
When DHCP snooping is disabled or in non-DHCP environments, use ARP ACLs to permit or to deny
packets.
VLAN ports.
Do not enable Dynamic ARP inspection on RSPAN VLANs. If Dynamic ARP inspection
Note
is enabled on RSPAN VLANs, Dynamic ARP inspection packets might not reach the
RSPAN destination port.
the channel port match. Otherwise, the physical port remains suspended in the port channel. A port
channel inherits its trust state from the first physical port that joins the channel. Consequently, the trust
state of the first physical port need not match the trust state of the channel.
Conversely, when you change the trust state on the port channel, the switch configures a new trust state
on all the physical ports that comprise the channel.
this means that the actual rate limit might be higher than the configured value. For example, if you set
the rate limit to 30 pps on an EtherChannel that has one port on switch 1 and one port on switch 2, each
port can receive packets at 29 pps without causing the EtherChannel to become error-disabled.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
Restrictions for Dynamic ARP Inspection
Default Settings
When dynamic ARP inspection is enabled, all denied
or dropped ARP packets are logged.
The number of entries in the log is 32.
The number of system messages is limited to 5 per
second.
The logging-rate interval is 1 second.
All denied or dropped ARP packets are logged.
201