Examkin

Question

Difficulty: HardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network engineer enables Dynamic ARP Inspection (DAI) on VLAN 20 of a Cisco Catalyst switch where DHCP Snooping is also active. All access interfaces on VLAN 20 are left in the default untrusted state. A critical host connected to interface GigabitEthernet1/0/12 is configured with a static IP address (192.168.20.50/24192.168.20.50/24) and MAC address (0050.56a1.23bc0050.56a1.23bc). Consequently, DAI drops all ARP requests sent by this host because no entry exists for it in the DHCP snooping binding database. The engineer must allow this host to communicate while keeping GigabitEthernet1/0/12 untrusted and maintaining DAI protection on VLAN 20. Which command sequence must be configured on the switch to resolve this issue?

  1. Define an ARP ACL using 'arp access-list STATIC_HOST', permit IP 192.168.20.50 and MAC 0050.56a1.23bc, and apply it with 'ip arp inspection filter STATIC_HOST vlan 20'.Answer
  2. B
    Execute 'copy running-config startup-config' on the switch CLI so that the static IP address and MAC mapping are saved to NVRAM and populated into the DHCP snooping database.
  3. C
    Modify the native VLAN on interface GigabitEthernet1/0/12 to match the management VLAN so that DAI validation rules are bypassed on the port.
  4. D
    Apply the command 'ip helper-address 192.168.20.50' under interface GigabitEthernet1/0/12 to force DAI to redirect ARP packets to the gateway.

Answer

Configure an ARP access list matching the static IP and MAC addresses ('arp access-list STATIC_HOST' followed by 'permit ip host 192.168.20.50 mac host 0050.56a1.23bc') and bind it to DAI on the VLAN using 'ip arp inspection filter STATIC_HOST vlan 20'.
Dynamic ARP Inspection (DAI) validates ARP requests and responses on untrusted ports against the DHCP snooping binding database. Because hosts with static IP configurations do not request IP addresses via DHCP, their IP-to-MAC mappings do not exist in the snooping database. To support static hosts without configuring the port as trusted (which would disable DAI checks entirely on that interface), an ARP access list (ARP ACL) must be configured with the host IP and MAC address, then applied to the VLAN using the 'ip arp inspection filter' command.

Step-by-Step Solution

1
Analyze the cause of packet drops under Dynamic ARP Inspection (DAI).
DAI inspects ARP packets on untrusted ports against the DHCP snooping binding database. Statically addressed hosts do not generate DHCP requests, so they lack database entries and their ARP traffic is dropped.
Untrusted ports undergo mandatory IP-to-MAC binding verification by DAI.
2
Identify the Cisco IOS mechanism for bypassing DHCP snooping database checks for static hosts while preserving DAI.
Configuring an ARP ACL allows administrators to manually define static IP-to-MAC bindings.
DAI evaluates configured ARP ACLs first before falling back to the DHCP snooping binding database.
3
Apply the ARP ACL to the targeted VLAN.
The command 'ip arp inspection filter <acl-name> vlan <vlan-id>' explicitly permits the static host ARP traffic on untrusted ports.
This maintains port untrusted security status for all other hosts while granting an exception for the static host.

Key Concept

Dynamic ARP Inspection (DAI) ARP ACL Integration for Statically Configured Hosts
Estimated Time:2m 0s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic