In the previous video and lab, we
enabled Dynamic ARP inspection on VLAN 30.
We also set up port 3/3 as a trusted port
so any ARP messages coming in on that port from the router
or anybody else off that port aren't going to be checked.
However, we ran into a little bit of a problem, that
is on gig 0/1, there's some ARP messages that
are being dropped simply because they're being sourced
from entities or devices that have not been dynamically
learned, and they're not part of the DHCP snooping table.
So to solve that, we're going to create an ARP access control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to solve that, we're going to create an ARP access control
list.
This ARP list is going to have an IP address and a layer 2
address.
And then we hand that over to Dynamic
ARP inspection and say, guess what?
In addition to the DHCP bindings that you dynamically
learn for DHCP clients, also check this list.
If they match up there, they're OK.
So let's take a peek at our topology again.
And then I'll walk you through the syntax
for creating and enabling an ARP access list.
So here's our topology once again.
And I've reset the lab, which will give us an opportunity WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I've reset the lab, which will give us an opportunity
to implement ARP inspection again for VLAN 30.
We can also set up port 3/3 as a trusted port again.
And then when we start getting additional ARP messages that
are being denied off gig 0/1, I'll
walk you through step-by-step of creating an ARP access control
list that'll identify the layer 3
address and the corresponding layer 2 address.
And as a result, the switch can then verify ARP messages
from those devices as well, even though those devices were not
DHCP clients and they weren't dynamically learned WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
DHCP clients and they weren't dynamically learned
through DHCP snooping.
So to confirm, let's to a show ip dhcp
snooping and binding just to verify
what the switch can work with.
So for VLAN 30, it knows about one mapping.
And that's this layer 3 address to this layer 2 address,
and that's it.
It doesn't know about anything else.
So we're going to re enable Dynamic ARP inspection
because I've reset the lab.
So we're going to go to interface gig 3/3,
and we'll do an ip arp inspection.
And we'll say trust that port.
Great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Great.
Exit out of interface config.
And then we'll do an ip arp inspection for VLAN 30.
And that will enable it.
And because I still have those talkers hanging off of gig
0/1 that were not DHCP clients and not
part of the DHCP stooping binding information,
we're going to see those messages pop up here
in just a few moments.
So while that's cooking, while we're
waiting for those messages, we can create an ARP access list.
And it goes like this--
arp space access list.
And then we give it a name.
Let's call it OUR uppercase LIST.
Just like that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Just like that.
And in this ARP access list, it's
asking us for permit or deny statements
regarding combinations of Mac addresses and IP addresses.
So for example, this one right here, this guy at 10.1.0.111
with his layer 2 address.
This switch just doesn't know about that mapping.
So it can't verify that it's a valid ARP message.
So if we wanted to add this to our access control list,
we'd say permit ip host.
And then we'd put in the IP address of this host
where we want the mapping to be.
So I'm going to Copy-Paste 10.1.0.111 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'm going to Copy-Paste 10.1.0.111
space we'll type in mac space.
And then we have some options.
And if we want to specify the Mac address,
we'd use the keyword host space and then the 48 bits
here, which is the 12 hexadecimal characters.
I'm going to Copy-Paste that in, press Enter.
And now that's one of our two entries.
Now 111 was one of our offenders here.
If I scroll up a little bit, I think there was another one.
But until it comes up on the screen,
I won't see what that is.
So let me just show you how to apply this access control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let me just show you how to apply this access control
list to ARP inspection.
And the way we do that, we'll exit out of access list
configuration mode.
And we use the command ip arp inspection filter and then
the name of the filter.
So the name of the filter, if it's--
what we call it?
Let me scroll up a little bit.
Here we go.
We called it OUR-LIST.
So just going to Copy-Paste that space
and then where we want to apply it-- vlan 30.
Press Enter.
Oh, and there's our other guy right there.
It's 120. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's 120.
So the 111 is going to drop off.
Those messages are going to stop because we're now
able to match on him.
Our DAI is-- Dynamic ARP inspection.
But let's add another entry for 120.
So I'm going to hit the up arrow key a few times.
And we'll go back into our access list configuration.
And we'll say permit ip host space.
And we'll add 10.1.0.120.
We'll Copy-Paste that.
And then we use the keyword mac and the keyword host.
And then we'll put in his layer 2 address right there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll put in his layer 2 address right there.
And with that done, that should settle him down
because he's now able to be matched.
So Dynamic ARP inspection is going
to two places for a confirmation of what the correct layer 3
and layer 2 mapping should be.
It's going to use the DHCP snooping binding table
if we just show ip dhcp snoop.
And binding, it's going to use this.
So this is how it knows about this bad boy that's
highlighted there.
It's also going to use the show arp access-list that we just
created to identify that mapping. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
created to identify that mapping.
And we can verify that with a show ip arp
inspection for vlan 30.
And that will show us as well.
So ARP inspection is enabled for the VLAN.
And there's our list that's also being used as a check
to see whether or not the layer 3 and layer 2 mappings
are correct regarding ARP messages.
And then one more command.
We just show ip arp inspection statistics.
Press Enter.
This is also a great thing to do.
So if we take a look at the permits here--
ACL Permits, 46, we've had 46 matches on that access control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ACL Permits, 46, we've had 46 matches on that access control
list that we just set up that are now
being allowed-- those ARP messages-- because they're
being permitted in the ARP ACL.
And just for grins, to move the counters a little bit
from something other than matching on the ACL,
let's go ahead and go to our Kali Linux box.
This is a computer sitting off of gig 0/1 as well.
If we do an config on this guy, he's at 10.16.20.102.
And his Mac address ends in 77:77:01. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And his Mac address ends in 77:77:01.
Yeah, that's the guy that was in the snooping table.
That's great.
So if we do a ping to 10.16.20--
what network are we on?
We're on the 20 subnet.
Lets just go ahead and hit our default gateway at dot 7.
If we didn't already have that information cached
as far as the layer 2 address, that would have cached it.
But if we go back to DCNUG, and we hit the up arrow key,
for show ip arp inspection statistics,
you'll notice that we have the ACL that permitted 99.
But we have forwarded 101. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But we have forwarded 101.
And that's because we had at least one from that client--
the Kali Linux box--
that was also forwarded.
But he was in the DHCP snooping table.
So that was allowed.
I hope this has been informative for you.
And I'd like to thank you for viewing.