01-02-2008 06:21 AM - edited 03-09-2019 07:45 PM
I am trying to inspect vlan 100 using Dynamic ARP inspection feature. My fwsm blade provides dhcp services to Vlan 100 users. Below is my configuration.
ip dhcp snooping vlan 100
ip dhcp snooping
ip arp inspection vlan 100
vlan 100,200,300
!
!
interface GigabitEthernet0/1
description ***DATA VLAN***
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 1000
duplex full
spanning-tree portfast
!
interface GigabitEthernet0/2
description ***DATA VLAN***
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 1000
duplex full
spanning-tree portfast
interface GigabitEthernet0/49
description ***UPLINK PORT TO FWSM-1***
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100-124,400
switchport mode trunk
ip arp inspection trust
speed nonegotiate
ip dhcp snooping trust
interface GigabitEthernet0/50
description ***UPLINK PORT TO FWSM-2***
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 200,430
switchport mode trunk
ip arp inspection trust
speed nonegotiate
ip dhcp snooping trust
I keep getting the following message and denies all access to the network
%SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi0/5, vlan 100.([0016.d3b5.30a4/10.0.0.4/0000.0000.0000/10.0.0.1/07
Please suggest if I am missing anything.
Regards,
Vinod Rathi
01-08-2008 09:45 AM
This message means that the switch has received Address Resolution Protocol (ARP) packets considered invalid by ARP inspection. The packets are erroneous, and their presence can show attempted man-in-the-middle attacks in the network. This log message appears when the IP and MAC address of the sender binding for the received VLAN is not present in the DHCP snooping database.
You receive this message when the MAC address does not match the binding. In order to display the DHCP snooping binding entries, use the show ip dhcp snooping binding command. If the device does not use DHCP or the information is correct and you trust the device on the port, you can enable trust on that port with the ip arp inspection trust command. Also, DHCP snooping must be enabled in order to permit ARP packets that have dynamically assigned IP addresses with the ip dhcp snooping command.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide