Welcome back.
In the previous video, we took a look
at the syntax, the commands, to implement and verify
dynamic ARP inspection.
And it's now time to put those commands to work.
Let's take a look at our diagram,
and then we'll go to the lab.
So here's our plan.
We're going to implement dynamic ARP inspection for VLAN 30
on this switch.
And the command is IP, ARP, inspection, VLAN 30.
And to set this interface, 3/3 is a trusted port.
We'd use the command and interface
config on the switch, IP, ARP, inspection, trust. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
config on the switch, IP, ARP, inspection, trust.
Then we can verify our work with the show, IP, ARP,
inspection for that VLAN.
And as we jump into the CLI, I've got a question for you.
I know that dynamic ARP inspection
is going to check the ARP messages, just to make sure
that nobody is lying.
Well, it has to know what the correct layer 3 and layer
2 combos are for each of the hosts.
Do you recall where it's going to look
to see whether or not the layer 3 and layer 2 information
matches up?
What is the other source of that information
that it's going to pull from?
Do you remember? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Do you remember?
And if you're saying, Keith, I think it was DHCP snooping,
you are right.
So the first thing we're going to do before we start
configuring anything is, we want to verify if DHCP snooping is
enabled and see if there's any entries in the DHCP snooping
binding so that ARP inspection has something to work with.
That's really important.
So let's take a look at that first.
So here on the switch, let's do a show IP DHCP snooping.
And we use the keyword "binding" and press Enter.
And sure enough, we've got two entries.
We're concerned with VLAN 30. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're concerned with VLAN 30.
So it knows at least one here.
This Mac address with this IP address is on port gig 0
slash 1 in VLAN 30.
So once we enable dynamic ARP inspection,
it can use this entry here as a way
to check to see whether or not the layer 3 and layer 2
information is correct for our device.
We also should do a show IP ARP inspection for VLAN 30,
just to make sure it's not yet configured.
So that's a great starting point for us.
It's not yet enabled.
So let's enable it.
We'll do a config T. And I've got a question for you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll do a config T. And I've got a question for you.
Let's go back to our topology for a moment.
Should we make this a trusted interface first,
before we enable the feature for the VLAN?
I'm thinking we should.
Otherwise, we're going to get errors anytime R3 does
ARP messages, because R3 does not have a dynamically learned
address.
So it's not in the DHCP snooping binding table.
So I would recommend we make this 3/3 interface trusted
first, and then we enable the ARP inspection on VLAN 30.
So we'll go to interface gig 3/3. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll go to interface gig 3/3.
And also, we should verify that we're on the right port.
How do we know that interface gig 3/3 here on the switch
connects out to R3?
And one way of doing that would be a do show CDP neighbor.
And that's going to verify it for us.
So our local interface gig 3/3 does indeed go to R3.
Fantastic.
So here, we'll do an IP ARP inspection question mark
and trust, and press Enter.
And then we'll enable ARP inspection
for the VLAN with IP.
ARP inspection for VLAN and 30, and press Enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ARP inspection for VLAN and 30, and press Enter.
And then we'll type it, end.
And we'll do a show IP ARP inspection for VLAN 30.
Press Enter.
And check this out.
We have a lot activity going on here.
So we have a lot of denies going on here.
And they're all coming in on gig 0/1.
Look at the IP addresses.
We have 10.1.0.111 and 10.1.0.120.
Let's talk about why that's happening.
And here's what's going on.
Off of this one port, I've got some other devices WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Off of this one port, I've got some other devices
on the 10.1 network.
So although it's one broadcast domain down here,
I've got different devices, thinking
it's different subnets.
So I've got some devices on 10.1.0
that are sending ARP messages.
And they're working their way up to this port,
because they're broadcast-based.
And the switch is saying, nope, I
don't have any information in the DHCP snooping table that
says this specific IP address of dot 111, or whatever it was,
and because I can't verify it, because I don't know,
I'm going to drop you.
And that's what those messages are. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's what those messages are.
So what we've done is, we've applied ARP inspection
for VLAN 30.
We made 3/3 a trusted port.
We also did a Show command to verify that it's configured.
But now our challenge is, we've got some ARP messages
from other devices off of this port
down here that are being denied on this switch port.
And that provides a perfect segue for the next video,
because the next video and lab, what we're going to do
is, we're going to take devices that are not being learned
via DHCP snooping and create static entries that basically WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
via DHCP snooping and create static entries that basically
tell us the switch, you know what, this IP address
and this layer 2 address, they match up.
Go ahead and use it, even if it's not
in the DHCP snooping table.
And as a result, by looking at that list and saying, oh, yep,
these match, the dynamic ARP inspection
can check on ARP messages, even though they haven't
been learned via DHCP snooping.
So we'll do that with a ARP ACL in the very next video.
So I'll see there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.