12.1.5 Dynamic ARP checking

(1) Overview

Dynamic ARP inspection monitors the ARP packets that pass through the Switch to restrict access of ARP packets from untrusted terminals.

The following figure provides an overview of how dynamic ARP inspection works.

(2) Port type

Like DHCP snooping, dynamic ARP inspection categorizes ports as follows when it monitors ARP packets:

• Trusted port

  A port is trusted when a trusted terminal is connected to it, such as DHCP servers and department servers.

  Dynamic ARP inspection does not monitor ARP packets that are received on trusted ports.

• Untrusted port

  A port is untrusted when an untrusted terminal is connected to it, such as DHCP clients.

  Do not connect DHCP servers to untrusted ports.

The following figure shows the two port categories used when dynamic ARP inspection is enabled and an example of devices connected to such ports.

When you use the ip dhcp snooping configuration command to enable DHCP snooping, all the ports become untrusted by default. Set the port to which a DHCP server is connected as a trusted port. You can set ports as trusted by using the ip arp inspection trust configuration command.

Note that dynamic ARP inspection monitors the VLANs that are specified by using the ip arp inspection vlan configuration command.

For normal operations, we recommend that you specify the same ports in both the ip dhcp snooping trust and ip arp inspection trust configuration commands.

(3) Basic Inspection of ARP Packets

When the switch receives an ARP packet on an untrusted port, the switch checks whether the source of the packet is in the binding database.If the packet comes from an unregistered terminal, the switch discards the packet.

The following table describes the basic inspection items.

(4) Optional Checking for ARP Packets

Optionally, the switch can check the integrity of data in the ARP packets received on untrusted ports.

To set optional inspection, use the ip arp inspection validate configuration command.