Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator enables Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to mitigate ARP spoofing attacks across the corporate subnet. Although DHCP clients operate without interruption, several critical servers using statically configured IP addresses immediately lose network access. Switch logs indicate that DAI is actively dropping all ARP packets generated by these static servers because their IP-to-MAC bindings do not exist in the DHCP snooping binding database. Which configuration step must be performed to restore network connectivity for the static servers while maintaining DAI protection on VLAN 10?

  1. Define an ARP Access Control List (ACL) mapping the static IP and MAC addresses, and apply it to VLAN 10 using the ip arp inspection filter command.Answer
  2. B
    Save the active configuration using the copy running-config startup-config command so the switch can automatically convert static ARP entries into sticky MAC bindings.
  3. C
    Reconfigure the access switchports connected to the static servers as 802.1Q trunk interfaces to bypass Layer 2 inspection on the native VLAN.
  4. D
    Enable DHCP relay on the server interfaces using the ip helper-address command so the switch can retroactively populate the DHCP snooping database.

Answer

Define an ARP Access Control List (ACL) mapping the static IP and MAC addresses, and apply it to VLAN 10 using the ip arp inspection filter command.
Dynamic ARP Inspection relies by default on the DHCP snooping binding database to verify IP-to-MAC address relationships in ARP packets on untrusted ports. Because static servers never request an IP address via DHCP, their bindings are absent from the database. Defining an ARP ACL with static IP-to-MAC entries and binding it to DAI using the `ip arp inspection filter` command allows the switch to validate and permit legitimate ARP traffic from static hosts.

Step-by-Step Solution

1
Identify the cause of packet drops under Dynamic ARP Inspection (DAI).
DAI intercepts all ARP requests and responses on untrusted ports and validates them against the DHCP snooping binding database. Statically addressed hosts do not use DHCP, so they lack entries in the database, causing DAI to drop their ARP packets.
Understanding why static hosts fail under DAI is essential for selecting the correct non-disruptive bypass mechanism.
2
Define an ARP ACL for static IP-to-MAC mappings.
Configuring an ARP ACL (`arp access-list <name>`) allows explicit static mapping of IP addresses to MAC addresses (e.g., `permit ip host <IP> mac host <MAC>`).
ARP ACLs provide a manual binding table that DAI checks when validating ARP packets.
3
Apply the ARP ACL to the affected VLAN.
Executing `ip arp inspection filter <acl-name> vlan 10 [static]` instructs DAI to consult the ARP ACL for validation on VLAN 10.
Linking the ARP ACL to DAI ensures static server ARP traffic is validated and permitted without disabling DAI security.

Key Concept

Dynamic ARP Inspection (DAI) Static Host Validation via ARP ACLs
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic