Cisco Systems 3130 User Manual
22-8
Cisco Catalyst Blade Switch 3130 for Dell Software Configuration Guide
OL-13270-01
Chapter 22 Configuring Dynamic ARP Inspection
Configuring Dynamic ARP Inspection
To disable dynamic ARP inspection, use the no ip arp inspection vlan vlan-range global configuration
command. To return the interfaces to an untrusted state, use the no ip arp inspection trust interface
configuration command.
command. To return the interfaces to an untrusted state, use the no ip arp inspection trust interface
configuration command.
This example shows how to configure dynamic ARP inspection on Switch A in VLAN 1. You would
perform a similar procedure on Switch B:
perform a similar procedure on Switch B:
Switch(config)# ip arp inspection vlan 1
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# ip arp inspection trust
Configuring ARP ACLs for Non-DHCP Environments
This procedure shows how to configure dynamic ARP inspection when Switch B shown in
does not support dynamic ARP inspection or DHCP snooping.
Step 3
ip arp inspection vlan vlan-range
Enable dynamic ARP inspection on a per-VLAN basis. By
default, dynamic ARP inspection is disabled on all VLANs.
default, dynamic ARP inspection is disabled on all VLANs.
For vlan-range, specify a single VLAN identified by VLAN ID
number, a range of VLANs separated by a hyphen, or a series of
VLANs separated by a comma. The range is 1 to 4094.
number, a range of VLANs separated by a hyphen, or a series of
VLANs separated by a comma. The range is 1 to 4094.
Specify the same VLAN ID for both switches.
Step 4
interface interface-id
Specify the interface connected to the other switch, and enter
interface configuration mode.
interface configuration mode.
Step 5
ip arp inspection trust
Configure the connection between the switches as trusted.
By default, all interfaces are untrusted.
The switch does not check ARP packets that it receives from the
other switch on the trusted interface. It simply forwards the
packets.
other switch on the trusted interface. It simply forwards the
packets.
For untrusted interfaces, the switch intercepts all ARP requests
and responses. It verifies that the intercepted packets have valid
IP-to-MAC address bindings before updating the local cache and
before forwarding the packet to the appropriate destination. The
switch drops invalid packets and logs them in the log buffer
according to the logging configuration specified with the ip arp
inspection vlan logging global configuration command. For
more information, see the
and responses. It verifies that the intercepted packets have valid
IP-to-MAC address bindings before updating the local cache and
before forwarding the packet to the appropriate destination. The
switch drops invalid packets and logs them in the log buffer
according to the logging configuration specified with the ip arp
inspection vlan logging global configuration command. For
more information, see the
Step 6
end
Return to privileged EXEC mode.
Step 7
show ip arp inspection interfaces
show ip arp inspection vlan vlan-range
Verify the dynamic ARP inspection configuration.
Step 8
show ip dhcp snooping binding
Verify the DHCP bindings.
Step 9
show ip arp inspection statistics vlan
vlan-range
vlan-range
Check the dynamic ARP inspection statistics.
Step 10
copy running-config startup-config
(Optional) Save your entries in the configuration file.
Command
Purpose