Cisco 7604 User Manual

38-21
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 38 Configuring Dynamic ARP Inspection
DAI Configuration Samples
Sample Two: One Switch Supports DAI
This procedure shows how to configure DAI when Router B shown in Figure 38-2 on page 38-4 does not
support DAI or DHCP snooping.
If switch Router B does not support DAI or DHCP snooping, configuring Fast Ethernet port 6/3 on
Router A as trusted creates a security hole because both Router A and Host 1 could be attacked by either
Router B or Host 2.
To prevent this possibility, you must configure Fast Ethernet port 6/3 on Router A as untrusted. To permit
ARP packets from Host 2, you must set up an ARP ACL and apply it to VLAN 1. If the IP address of
Host 2 is not static, which would make it impossible to apply the ACL configuration on Router A, you
must separate Router A from Router B at Layer 3 and use a router to route packets between them.
To set up an ARP ACL on switch Router A, follow these steps:
Step 1 Configure the access list to permit the IP address 1.1.1.1 and the MAC address 0001.0001.0001, and
verify the configuration:
RouterA# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
RouterA(config)# arp access-list H2
RouterA(config-arp-nacl)# permit ip host 1.1.1.1 mac host 1.1.1
RouterA(config-arp-nacl)# end
RouterA# show arp access-list
ARP access list H2
permit ip host 1.1.1.1 mac host 0001.0001.0001
Step 2 Apply the ACL to VLAN 1, and verify the configuration:
RouterA# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
RouterA(config)# ip arp inspection filter H2 vlan 1
RouterA(config)# end
RouterA#
RouterA# show ip arp inspection vlan 1
Source Mac Validation : Disabled
Destination Mac Validation : Disabled
IP Address Validation : Disabled
Vlan Configuration Operation ACL Match Static ACL
---- ------------- --------- --------- ----------
1 Enabled Active H2 No
Vlan ACL Logging DHCP Logging
---- ----------- ------------
1 Deny Deny
RouterA#
Step 3 Configure Fast Ethernet port 6/3 as untrusted, and verify the configuration:
RouterA# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
RouterA(config)# interface fastethernet 6/3
RouterA(config-if)# no ip arp inspection trust
RouterA(config-if)# end
Switch# show ip arp inspection interfaces fastethernet 6/3
Interface Trust State Rate (pps)
--------------- ----------- ----------

Cisco 7604 Specifications

General

Brand	Cisco
Model	7604
Category	Network Router
Language	English