Chapter 38
Configuring Dynamic ARP Inspection
Configuring Router B
To enable DAI and configure Fast Ethernet port 3/3 on Router B as trusted, follow these steps:
Verify the connectivity:
Step 1
RouterA# show cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
Device ID
RouterB
RouterB#
Enable DAI on VLAN 1, and verify the configuration:
Step 2
RouterB# configure terminal
Enter configuration commands, one per line.
RouterB(config)# ip arp inspection vlan 1
RouterB(config)# end
RouterB# show ip arp inspection vlan 1
Source Mac Validation
Destination Mac Validation : Disabled
IP Address Validation
Vlan
----
Vlan
----
RouterB#
Configure Fast Ethernet port 3/3 as trusted:
Step 3
RouterB# configure terminal
Enter configuration commands, one per line.
RouterB(config)# interface fastethernet 3/3
RouterB(config-if)# ip arp inspection trust
RouterB(config-if)# end
RouterB# show ip arp inspection interfaces
Interface
---------------
Gi1/1
Gi1/2
Gi3/1
Gi3/2
Fa3/3
Fa3/4
Fa3/5
Fa3/6
Fa3/7
<output truncated>
RouterB#
Step 4
Verify the list of DHCP snooping bindings:
RouterB# show ip dhcp snooping binding
MacAddress
OL-4266-08
S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone
Local Intrfce
Fas 3/3
Configuration
-------------
1
Enabled
ACL Logging
-----------
1
Deny
Trust State
-----------
Untrusted
Untrusted
Untrusted
Untrusted
Trusted
Untrusted
Untrusted
Untrusted
Untrusted
IpAddress
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
Holdtme
Capability
120
R S I
End with CNTL/Z.
: Disabled
: Disabled
Operation
ACL Match
---------
---------
Active
DHCP Logging
------------
Deny
End with CNTL/Z.
Rate (pps)
----------
15
15
15
15
None
15
15
15
15
Lease(sec)
Type
DAI Configuration Samples
Platform
Port ID
WS-C6506
Fas 6/3
Static ACL
----------
VLAN
Interface
38-19