Scenario Two: One Switch Supports Dynamic Arp Inspection - Cisco 4500M Software Manual

Chapter 34 Understanding and Configuring Dynamic ARP Inspection
The statistics will display as follows:
S2# show ip arp inspection statistics vlan 1
Vlan
----
Vlan
----
Vlan
----
S2#

Scenario Two: One Switch Supports Dynamic ARP Inspection

If switch S2 does not support DAI or DHCP snooping, configuring interface fa6/3 as trusted would leave
a security hole because both S1 and H1 could be attacked by either S2 or H2. To prevent this possibility,
you must configure interface fa6/3 as untrusted. To permit ARP packets from H2, you must set up an
ARP ACL and apply it to VLAN 1. If the IP address of H2 is not static, such that it is impossible to apply
the ACL configuration on S1, S1 and S2 must be separated at Layer 3, that is, have a router routing
packets between S1 and S2.
To set up an ARP ACL on switch S1, follow these steps:
Set up the access list to permit the IP address 1.1.1.1 and the MAC address 0001.0001.0001, and verify
Step 1
the configuration:
S1# conf t
Enter configuration commands, one per line.
S1(config)# arp access-list H2
S1(config-arp-nacl)# permit ip host 1.1.1.1 mac host 1.1.1
S1(config-arp-nacl)# end
S1# show arp access-list
ARP access list H2
Step 2 Apply the ACL to VLAN 1, and verify the configuration:
S1# conf t
Enter configuration commands, one per line.
S1(config)# ip arp inspection filter H2 vlan 1
S1(config)# end
S1#
S1# show ip arp inspection vlan 1
Source Mac Validation
Destination Mac Validation : Disabled
IP Address Validation
Vlan
----
OL-6696-01
Forwarded
---------
1 1
DHCP Permits ACL Permits
------------ -----------
1 1
Dest MAC Failures
-----------------
1 0
permit ip host 1.1.1.1 mac host 0001.0001.0001
Configuration
-------------
1 Enabled
Dropped DHCP Drops
------- ----------
1 1
Source MAC Failures
-------------------
0
IP Validation Failures
----------------------
0
End with CNTL/Z.
End with CNTL/Z.
: Disabled
: Disabled
Operation ACL Match
--------- ---------
Active H2
Software Configuration Guide—Release 12.2(25)EW
Configuring Dynamic ARP Inspection
ACL Drops
----------
0
0
Static ACL
----------
No
34-9