Cisco Catalyst 2960-XR Security Configuration Manual page 225

Configuring Dynamic ARP Inspection
If you configure port 1 on Switch A as trusted, a security hole is created because both Switch A and Host 1
could be attacked by either Switch B or Host 2. To prevent this possibility, you must configure port 1 on
Switch A as untrusted. To permit ARP packets from Host 2, you must set up an ARP ACL and apply it to
VLAN 1. If the IP address of Host 2 is not static (it is impossible to apply the ACL configuration on Switch
A) you must separate Switch A from Switch B at Layer 3 and use a router to route packets between them.
Beginning in privileged EXEC mode, follow these steps to configure an ARP ACL on Switch A. This procedure
is required in non-DHCP environments.
SUMMARY STEPS
1. Configureterminal
2. arp access-list acl-name
3. permit ip host sender-ip mac host sender-mac log
4. exit
5. ip arp inspection filter arp-acl-name vlan vlan-range [static]
6. interface interface-id
7. no ip arp inspection trust
8. end
9. show arp access-list acl-name show ip arp inspection vlan vlan-range show ip arp inspection interfaces
10. copy running-config startup-config
DETAILED STEPS
Command or Action
Step 1
Configureterminal
Step 2
arp access-list acl-name
Step 3 permit ip host sender-ip mac
host sender-mac log
Step 4 exit
Step 5 ip arp inspection filter
arp-acl-name vlan vlan-range
[static]
OL-29434-01
Purpose
Enter global configuration mode.
Define an ARP ACL, and enter ARP access-list configuration mode. By default, no
ARP access lists are defined.
At the end of the ARP access list, there is an implicitdeny ip any mac any
Note
command.
Permit ARP packets from the specified host (Host 2).
• Forsender-ip, enter the IP address of Host 2.
• For sender-mac, enter the MAC address of Host 2.
• (Optional) Specify log to log a packet in the log buffer when it matches the
access control entry (ACE). Matches are logged if you also configure the
matchlog keyword in theip arp inspection vlan logging global configuration
command. For more information, see the section, "Configuring the Log Buffer."
Return to global configuration mode.
Apply the ARP ACL to the VLAN. By default, no defined ARP ACLs are applied to
any VLAN.
• For arp-acl-name, specify the name of the ACL created in Step 2.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
Configuring ARP ACLs for Non-DHCP Environments
203