Examkin

Soru

Zorluk: Çok zorLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator is implementing Layer 2 security on VLAN 30 of a Cisco Catalyst switch. The VLAN contains both dynamic DHCP clients and devices with statically configured IP addresses. DHCP Snooping is active on VLAN 30.

To allow traffic from the static IP devices that do not exist in the DHCP snooping binding database, the administrator creates an ARP Access Control List (ACL) named `STATIC_DEVICES` matching the static MAC and IP pairs, and executes the following command:

`Switch(config)# ip arp inspection filter STATIC_DEVICES vlan 30`

Immediately after applying this command, static IP hosts communicate successfully, but all dynamic DHCP clients on VLAN 30 lose connectivity because their ARP packets are dropped by Dynamic ARP Inspection (DAI).

Which configuration modification must be made to permit ARP traffic from both static IP devices and dynamic DHCP clients?

  1. Re-enter the command with the `static` keyword: `ip arp inspection filter STATIC_DEVICES vlan 30 static`.Cevap
  2. B
    Save the configuration using `copy running-config startup-config` and reload the switch to force DAI to populate static entries into the binding database.
  3. C
    Configure `ip dhcp snooping trust` on all host access ports on VLAN 30 to bypass DAI validation.
  4. D
    Add `ip arp inspection validate src-mac dst-mac ip` in global configuration mode to bypass binding database checks.

Cevap

Re-entering the command with the `static` keyword (`ip arp inspection filter STATIC_DEVICES vlan 30 static`) allows unlisted ARP packets to fall back to verification against the DHCP snooping binding database.
When an ARP ACL is bound to a VLAN for Dynamic ARP Inspection without the `static` keyword, the ARP ACL becomes the sole authority for ARP validation on that VLAN. Packets that do not match an explicit entry in the ARP ACL hit the implicit `deny any` and are dropped without consulting the DHCP snooping binding database. Appending the `static` keyword (`ip arp inspection filter STATIC_DEVICES vlan 30 static`) instructs DAI to check the ARP ACL first for static hosts, and if no match is found, fall back to checking the DHCP snooping binding database for dynamic clients.

Adım Adım Çözüm

1
Analyze how DAI evaluates ARP ACL filters without the `static` keyword.
When `ip arp inspection filter <acl-name> vlan <vlan>` is applied without `static`, DAI checks the specified ARP ACL exclusively. If an ARP packet does not match an explicit `permit` entry, it hits the implicit `deny` at the end of the ACL and is dropped without checking the DHCP snooping binding database.
Omitting `static` makes the ARP ACL authoritative for all ARP traffic on that VLAN.
2
Determine the effect of adding the `static` keyword to the DAI filter command.
Including the `static` keyword (`ip arp inspection filter <acl-name> vlan <vlan> static`) changes the evaluation flow: DAI checks the ARP ACL first. If no match is found in the ACL, DAI falls back to evaluating the packet against the DHCP snooping binding database.
This allows static IP devices (permitted by the ARP ACL) and dynamic DHCP clients (validated via the binding database) to coexist on the same VLAN.

Anahtar Kavram

DAI ARP ACL Filtering Mechanics and the `static` Keyword Fallback
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Bu konudan daha fazla soru