From the previous video, we identified
that a device lying in ARP messages
about layer 2 address information
is bad news for the network.
So we're going to solve it with Dynamic ARP Inspection--
DAI.
So in this video, let's take a look
at the syntax for how we would apply it,
and we'll also have the opportunity
to talk about the concept of a Dynamic ARP Inspection trusted
interface as well.
And let's use this topology as our backdrop for the discussion
for a Dynamic ARP Inspection and how to implement it.
So we'd start off with a switch that supports Dynamic ARP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'd start off with a switch that supports Dynamic ARP
Inspection.
It has the feature set.
And one of the questions that we have
to ask ourselves is, well, if the switch is going
to check on the ports for ARP messages and make sure
that the correct layer 3 addresses
map to the right layer 2 address, how does it know?
That's a good question.
The primary way, when we implement
this, that the switch is going to know what
the corresponding layer 3 and layer 2 address is,
is from the DHCP snooping.
So unless we want to manually configure all of the mappings
for all of our clients with this IP
address and this MAC address, we'd
want to rely on DHCP snooping. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
want to rely on DHCP snooping.
So it's pretty cool that that information with DHCP snooping
can be used by Dynamic ARP Inspection for the ARP checks.
So we have a router that's connected to a switch.
There's a trunk here, which implies
we may have some multiple sub-interfaces here.
And then from the switch we have a couple of ports.
Gig 0/1 is associated with VLAN 30.
Here's the subnet of 10.16.20.0.
And to implement Dynamic ARP Inspection for VLAN 30,
here's what we do.
We'd use this command in global config--
IP, space, ARP, space, inspection, space, VLAN, space, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
IP, space, ARP, space, inspection, space, VLAN, space,
30.
Press Enter.
Boom!
And it's applied.
Now, every ARP message that goes into the switch
is going to be checked.
It's going to say, hey, is that the correct layer 2 address
that you're advertising, or you're responding with
based on your IP address?
And if it's not, it's going to deny that message
from entering the switch.
Now, a really important question is, how does the switch know?
How does the switch know what the corresponding IP and MAC
addresses are?
That's a good question.
And one way, and the most popular way of implanting this,
is by using DHCP snooping also. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is by using DHCP snooping also.
See, if we use DHCP snooping, which
we covered in separate Skill, it's
going to listen to DHCP messages,
and it will dynamically build a table
that has the IP address and the layer 2 addresses.
And now DAI--
Dynamic ARP Inspection-- swoops in and says,
great, I'm going to use that table.
Thanks DHCP snooping!
I'm going to use that table as I verify
the responses in MAC addresses to make sure
that nobody's lying about their layer 2 information.
That's how it works.
So although it's possible to configure all our devices--
their layer 3 layer 2 information manually-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
their layer 3 layer 2 information manually--
the most popular way is to also include DHCP snooping,
and that will capture all the layer 3 and layer 2
mappings for our DHCP clients.
Now, what about devices that are not DHCP clients?
Like router 3, it's not a DHCP client.
What do we do there?
Well, we can manually statically configure the layer 3 and layer
2 mapping and tell Dynamic ARP Inspection to use that,
or we can specify this port on the switch
where R3 is connected as a trusted port.
And so if R3 is associated with VLAN 30, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so if R3 is associated with VLAN 30,
but this port is a trusted port, the switch says, ah,
you know, ARP messages coming in that port, not going to check.
Your free and clear.
Have a good day.
While at the same time, all the other ports,
which are untrusted from a Dynamic ARP Inspection
perspective, all the other ports will have their messages
checked for the correct layer 3, layer 2 mapping.
So if we wanted to configure interface 3/1 a trusted port,
we'd use this command right here in interface config, IP, space,
ARP, space, inspect, space, trust.
Press Enter, and no more checking on interface 3/3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Press Enter, and no more checking on interface 3/3.
And if we wanted to verify that Dynamic ARP Inspection was
applied, we could use a command show, IP, ARP, inspection,
VLAN, and then the VLAN that we want to look at.
So in this video, we took a look at the commands
to implement Dynamic ARP Inspection.
And in the next video, you and I get
to actually apply it and verify it on a switch.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.