Examkin

Soru

Zorluk: ZorLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

An enterprise network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 using the command `ip arp inspection vlan 10`. Host devices dynamically receiving IPv4 configuration via DHCP operate without issue. However, a critical server connected to access switchport GigabitEthernet0/2 in VLAN 10 is configured with a static IPv4 address (192.168.10.50/24192.168.10.50/24) and MAC address (0011.2233.44550011.2233.4455). Network telemetry indicates that all network traffic from this server is dropped because DAI marks its ARP packets as invalid. Which configuration step correctly resolves the ARP packet drop for this static host while maintaining active DAI protection on VLAN 10?

  1. Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.Cevap
  2. B
    Configure `switchport port-security mac-address sticky 0011.2233.4455` on interface GigabitEthernet0/2 without saving the running-config to startup-config.
  3. C
    Reassign interface GigabitEthernet0/2 to an unused native VLAN so untagged ARP frames bypass the switch DAI inspection engine.
  4. D
    Configure the `ip helper-address` command on interface GigabitEthernet0/2 pointing to the enterprise DHCP server address.

Cevap

Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.
Dynamic ARP Inspection (DAI) intercepts and validates all ARP packets on untrusted switch interfaces against the DHCP snooping binding database. Statically addressed hosts do not use DHCP and therefore lack entries in this database, causing DAI to discard their ARP traffic. To resolve this issue without disabling DAI, an administrator must create an ARP access list (`arp access-list`) defining the static IP and MAC address pairing, and associate it with the VLAN using `ip arp inspection filter <acl-name> vlan <vlan-id>`.

Adım Adım Çözüm

1
Diagnose the root cause of packet drops under Dynamic ARP Inspection (DAI)
DAI intercepts ARP requests and responses on untrusted ports and validates the sender's IP-to-MAC mapping against the DHCP snooping binding database. Because the server uses a static IP address, no DHCP transaction occurred, resulting in no database entry and subsequent ARP packet drops.
Static IP devices naturally lack dynamic entries in the switch DHCP snooping binding database.
2
Identify the Cisco IOS mechanism for authorizing non-DHCP static hosts under DAI
Define an ARP Access Control List (`arp access-list <name>`) and add a permit entry binding the host's static IP (192.168.10.50192.168.10.50) to its MAC address (0011.2233.44550011.2233.4455).
ARP ACLs provide a static verification table for DAI validation.
3
Apply the static ARP ACL to the VLAN inspection filter
Execute `ip arp inspection filter <acl-name> vlan 10` in global configuration mode.
This permits the static host's ARP packets to pass inspection while preserving DAI security enforcement for all other hosts in VLAN 10.

Anahtar Kavram

Dynamic ARP Inspection (DAI) Static ARP Access List Filtering
Bu soruyu puanla

Konular

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Bu konudan daha fazla soru