Jeremy's IT Lab CCNA Dynamic ARP Inspection Day 51

Apply an ARP ACL to DAI:

SW1(config)# [...]

ip arp inspection filter arp-acl-name vlan vlan

Configure a DAI trusted interface:

SW1(config-if)# [...]

ip arp inspection trust

Configure an ARP ACL entry mapping an IP address to a MAC address (permit)

SW1(config-arp-nacl)# [...]

permit ip host ip-address mac host mac-address

Configure DAI rate limiting:

SW1(config-if)# [...]

ip arp inspection limit rate packets [burst interval seconds]

Create an ARP ACL:

SW1(config)# [...]

arp access-list name

DAI checks ARP messages' [...] and [...] fields against the DHCP snooping binding table and ARP ACLs.

sender MAC / sender IP

DAI checks ARP messages' sender MAC and sender IP fields against the [...] and [...].

DHCP snooping binding table / ARP ACLs

DAI inspects ARP messages received on [...] ports.

untrusted

DAI rate limiting is enabled on [...] ports by default.

untrusted

DAI rate limiting is enabled on untrusted ports with a rate of [...] by default.

15 packets per second

DAI: All ports are [trusted/untrusted] by default.

untrusted

Does DAI inspect messages received on trusted ports?

no

Enable additional DAI validation checks:

SW1(config)# [...]

ip arp inspection validate (src-mac | dst-mac | ip)

Enable DAI for a VLAN:

SW1(config)# [...]

ip arp inspection vlan vlan

Enable err-disable recovery for DAI rate limiting:

SW1(config)# [...]

errdisable recovery cause arp-inspection

Show a summary of DAI configuration and statistics:

SW1# [...]

show ip arp inspection

Show a summary of DAI interfaces:

SW1# [...]

show ip arp inspection interfaces