A network administrator enables Dynamic ARP Inspection (DAI) on VLAN 20 of a Cisco Catalyst switch. DHCP Snooping is enabled on VLAN 20, but several legacy printers on untrusted access ports use static IPv4 addresses and are not recorded in the DHCP snooping binding database. Consequently, DAI drops legitimate ARP packets originating from these printers. Which two configuration actions must the administrator perform to allow ARP traffic from the static hosts while maintaining DAI inspection on those untrusted ports? (Select two.)
- Define an ARP Access Control List (ARP ACL) using `arp access-list` that maps the static host IP addresses to their corresponding MAC addresses.Answer
- Apply the ARP ACL to VLAN 20 using the global configuration command `ip arp inspection filter <acl-name> vlan 20`.Answer
- CExecute `copy running-config startup-config` so the switch automatically populates static host IP-to-MAC bindings into the persistent DHCP snooping database.
- DConfigure the interface command `ip arp inspection trust` on the access switch ports connected directly to the static host printers.
Answer
To support static hosts with Dynamic ARP Inspection (DAI) without disabling security on untrusted ports, the administrator must create an ARP ACL containing static IP-to-MAC mappings and apply that ARP ACL to the VLAN using the `ip arp inspection filter` command.
Dynamic ARP Inspection relies on the DHCP snooping binding database to validate ARP packets on untrusted ports. When hosts are configured with static IP addresses, their bindings are absent from the DHCP snooping table. The standard Cisco IOS solution is to create an ARP ACL containing static IP-to-MAC permits and apply it to the VLAN using `ip arp inspection filter <acl-name> vlan <vlan-id>`.
Step-by-Step Solution
Key Concept
Dynamic ARP Inspection (DAI) static host support via ARP ACLs