Examkin

Question

Difficulty: HardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network engineer is troubleshooting host connectivity issues on a Cisco Catalyst switch after enabling Dynamic ARP Inspection (DAI) on VLAN 50. Most clients receive their network settings dynamically via DHCP, but a legacy server connected to interface GigabitEthernet1/0/10 uses a static IP address. Because the server's IP-to-MAC mapping is absent from the DHCP snooping binding database, the switch drops all ARP packets originating from GigabitEthernet1/0/10. Which configuration sequence allows ARP traffic from this static server while maintaining active DAI inspection for all other hosts on VLAN 50?

  1. Define an ARP access control list matching the server's IP and MAC addresses, then apply it globally to VLAN 50 using the ip arp inspection filter command with the static keyword.Answer
  2. B
    Enable switchport port-security with sticky MAC learning on GigabitEthernet1/0/10 and execute write memory to insert the server's MAC address into the DHCP snooping database.
  3. C
    Configure GigabitEthernet1/0/10 with an explicit native VLAN mismatch so that incoming ARP requests bypass the DAI inspection engine.
  4. D
    Execute the ip dhcp snooping trust command on interface GigabitEthernet1/0/10 to dynamically add static IP addresses into NVRAM persistent memory.

Answer

The correct action is to define an ARP access control list specifying the static host's IP and MAC address mapping, and bind it to VLAN 50 using the command `ip arp inspection filter <acl-name> vlan 50 static`.
Dynamic ARP Inspection relies on the DHCP snooping binding database to validate ARP packets on untrusted interfaces. When network endpoints use static IP addressing, their entries do not exist in the DHCP binding database. To resolve this, administrators must configure an ARP ACL (`arp access-list`) containing the static host's MAC and IP address, and apply it to the VLAN via `ip arp inspection filter <acl_name> vlan <vlan-id> [static]`. The optional `static` keyword ensures that for IPs specified in the ACL, DAI only permits packets matching the configured MAC address and drops all others.

Step-by-Step Solution

1
Identify why Dynamic ARP Inspection (DAI) is dropping packets on interface GigabitEthernet1/0/10.
DAI inspects incoming ARP packets on untrusted ports against the DHCP snooping binding database. Statically configured hosts do not perform DHCP transactions, so their IP-to-MAC mappings are missing from the binding table.
Without a valid binding table entry, DAI flags incoming ARP requests/replies as invalid and drops them.
2
Determine the Cisco IOS mechanism to manually define static IP-to-MAC bindings for DAI.
Configuring an ARP Access Control List (ARP ACL) using `arp access-list <name>` allows explicit mapping of IP addresses to MAC addresses.
ARP ACLs supply static verification entries to DAI for hosts that do not utilize DHCP.
3
Apply the ARP ACL to the VLAN using the correct DAI command option.
Executing `ip arp inspection filter <acl-name> vlan 50 static` forces the switch to check the ARP ACL first.
Including the `static` keyword specifies an implicit deny for IP addresses defined in the ACL if their MAC addresses do not match, ensuring static hosts are authenticated without relying on DHCP snooping.

Key Concept

Dynamic ARP Inspection (DAI) ARP ACL Integration
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic