Examkin

Soru

Zorluk: OrtaLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to prevent ARP spoofing. DHCP snooping is enabled and functioning properly. However, several servers connected to untrusted access ports use statically assigned IP addresses, causing DAI to drop their legitimate ARP requests because they lack entries in the DHCP snooping binding database. Which configuration action should the administrator perform to permit ARP traffic from these static servers while maintaining DAI protection on VLAN 10?

  1. Configure an ARP Access Control List (ARP ACL) with static IP-to-MAC bindings and apply it to VLAN 10 using the ip arp inspection filter command.Cevap
  2. B
    Enable sticky MAC addressing using switchport port-security mac-address sticky on the server access ports without saving the running configuration.
  3. C
    Change the trunk native VLAN configuration on opposing switch ends so that static ARP frames bypass the Layer 2 inspection process.
  4. D
    Add the ip helper-address command on the egress interface towards the DHCP server to automatically generate static ARP bindings.

Cevap

Configure an ARP Access Control List (ARP ACL) with the static IP-to-MAC address mappings of the servers and apply it to VLAN 10 using the 'ip arp inspection filter' command.
Dynamic ARP Inspection (DAI) validates ARP requests and responses against the DHCP snooping binding database on untrusted ports. Because statically configured hosts do not send DHCP requests, they lack entries in the binding database. To prevent DAI from dropping legitimate traffic from these static hosts, administrators must create an ARP Access Control List (ARP ACL) with static IP-to-MAC mappings and map it to the VLAN using the 'ip arp inspection filter' command.

Adım Adım Çözüm

1
Identify the cause of dropped ARP packets
DAI inspects ARP packets on untrusted ports by matching their IP and MAC addresses against the DHCP snooping binding database. Statically addressed hosts have no entries in this database, causing DAI to drop their packets.
DAI relies by default on the DHCP snooping binding table for validation.
2
Determine the correct mitigation mechanism for static IP hosts
Cisco IOS allows creating an ARP ACL (`arp access-list`) containing explicit `permit ip host <IP> mac host <MAC>` statements for static hosts.
ARP ACLs act as a static reference database alongside DHCP snooping for DAI validation.
3
Apply the ARP ACL to Dynamic ARP Inspection
Execute `ip arp inspection filter <arp-acl-name> vlan 10` in global configuration mode.
This command instructs DAI to check the ARP ACL before or instead of the DHCP snooping database for traffic on VLAN 10.

Anahtar Kavram

Dynamic ARP Inspection (DAI) Static Host Validation via ARP ACLs
Bu soruyu puanla

Konular

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Bu konudan daha fazla soru