A network engineer deploys Dynamic ARP Inspection (DAI) and DHCP Snooping on VLAN 30 of a Cisco Catalyst switch. A workstation connected to an untrusted access port is configured with a static IPv4 address rather than obtaining one via DHCP. When the workstation attempts to communicate with the default gateway, all of its traffic is dropped at the switch port. Which command sequence should be configured on the switch to permit ARP traffic from this statically configured host while maintaining DAI protection?
- Define an ARP access list matching the static IP and MAC address, then apply it using the command ip arp inspection filter <ACL_NAME> vlan 30.Cevap
- BConfigure switchport port-security mac-address sticky on the access interface and save the configuration with write memory.
- CReconfigure the trunk uplink interface to use VLAN 30 as its native VLAN to bypass DAI packet inspection.
- DConfigure spanning-tree portfast on the access interface to immediately transition the port to the forwarding state.
Cevap
Define an ARP access list matching the static IP and MAC address, then apply it using the command ip arp inspection filter <ACL_NAME> vlan 30.
Dynamic ARP Inspection (DAI) intercept and validates all ARP requests and responses on untrusted ports against the DHCP snooping binding database. For hosts configured with static IP addresses, no entry exists in the DHCP binding database, causing DAI to drop their ARP packets. To permit static hosts while keeping DAI active, administrators must create an ARP access list defining the static IP-to-MAC pair and apply it globally to the VLAN using the command 'ip arp inspection filter <ACL_NAME> vlan <VLAN_ID>'.
Adım Adım Çözüm
Anahtar Kavram
DAI Static ARP ACL Integration
Tahmini Süre:1m 30s