Configuring Arp Acls For Non-Dhcp Environments - Cisco ME 3400 Software Configuration Manual

Configuring Dynamic ARP Inspection
Command
Step 6
ip arp inspection trust
Step 7 end
Step 8
show ip arp inspection interfaces
show ip arp inspection vlan vlan-range
Step 9
show ip dhcp snooping binding
Step 10 show ip arp inspection statistics vlan
vlan-range
Step 11 copy running-config startup-config
To disable dynamic ARP inspection, use the no ip arp inspection vlan vlan-range global configuration
command. To return the interfaces to an untrusted state, use the no ip arp inspection trust interface
configuration command.
This example shows how to configure dynamic ARP inspection on Switch A in VLAN 1. You would
perform a similar procedure on Switch B:
Switch(config)# ip arp inspection vlan 1
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip arp inspection trust

Configuring ARP ACLs for Non-DHCP Environments

This procedure shows how to configure dynamic ARP inspection when Switch B shown in
on page 20-3
If you configure port 1 on Switch A as trusted, a security hole is created because both Switch A and
Host 1 could be attacked by either Switch B or Host 2. To prevent this possibility, you must configure
port 1 on Switch A as untrusted. To permit ARP packets from Host 2, you must set up an ARP ACL and
apply it to VLAN 1. If the IP address of Host 2 is not static (it is impossible to apply the ACL
configuration on Switch A) you must separate Switch A from Switch B at Layer 3 and use a router to
route packets between them.
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
20-8
Purpose
Configure the connection between the switches as trusted.
By default, all interfaces are untrusted.
The switch does not check ARP packets that it receives from the
other switch on the trusted interface. It simply forwards the
packets.
For untrusted interfaces, the switch intercepts all ARP requests
and responses. It verifies that the intercepted packets have valid
IP-to-MAC address bindings before updating the local cache and
before forwarding the packet to the appropriate destination. The
switch drops invalid packets and logs them in the log buffer
according to the logging configuration specified with the ip arp
inspection vlan logging global configuration command. For
more information, see the
on page
Return to privileged EXEC mode.
Verify the dynamic ARP inspection configuration.
Verify the DHCP bindings.
Check the dynamic ARP inspection statistics.
(Optional) Save your entries in the configuration file.
does not support dynamic ARP inspection or DHCP snooping.
Chapter 20 Configuring Dynamic ARP Inspection
"Configuring the Log Buffer" section
20-12.
Figure 20-2
OL-9639-07