Basic Configuration; Example Configuration; Router Configuration - Enterasys SecureStack C2 C2G170-24 Configuration Manual

Dynamic ARP Inspection Overview

Basic Configuration

The following basic configuration does not change the default rate limiting parameters.
Procedure 17-2 Basic Dynamic ARP Inspection Configuration
Step
1.
2.
3.
4.
5.

Example Configuration

The following example configures DHCP snooping and dynamic ARP inspection in a routing
environment using RIP. The example configures two interfaces on the switch, configuring RIP on
both interfaces, assigning each to a different VLAN, and then enabling DHCP snooping and
dynamic ARP inspection on them:
• Interface ge.1.1, which is connected to a remote DHCP server, on VLAN 192
• Interface ge.1.2, which is connected to DHCP clients, on VLAN 10
In addition, the default VLAN, VLAN 1, is also enabled for DHCP snooping and dynamic ARP
inspection.
Since the DHCP server is remote, the switch has been configured as a DHCP relay agent (with the
ip helper‐address command), to forward client requests to the DHCP server. Therefore, MAC
address verification is disabled (with the set dhcpsnooping verify mac‐address disable
command) in order to allow DHCP RELEASE packets to be processed by the DHCP snooping
functionality and client bindings removed from the bindings database

Router Configuration

router
enable
configure
interface vlan 10
no shutdown
ip address 10.2.0.1 255.255.0.0
ip helper-address 192.168.0.200
ip rip send version 2
ip rip receive version 2
ip rip enable
17-18 DHCP Snooping and Dynamic ARP Inspection
Task
Configure DHCP snooping.
Enable ARP inspection on the VLANs where
clients are connected, and optionally, enable
logging of invalid ARP packets.
Determine which ports are not security threats
and configure them as DAI trusted ports.
If desired, configure optional validation
parameters.
If desired, configure static mappings for DAI by
creating ARP ACLs:
• Create the ARP ACL
• Apply the ACL to a VLAN
Command(s)
Refer to Procedure 17-1 on page 17-3.
set arpinspection vlan vlan-range
[logging]
set arpinspection trust port
port-string enable
set arpinspection validate
{[src-mac] [dst-mac] [ip]}
set arpinspection filter name permit
ip host sender-ipaddr mac host
sender-macaddr
set arpinspection filter name vlan
vlan-range [static]