Maipu Administration Guide

Combine ARP Check with DHCP Snooping

Network Requirements

PC1 and PC2 are connected to IP Network via Device; PC1 uses the static IP address and PC2 gets the IP address via DHCP.
Device configures the DHCP Snooping and ARP Check function, realizing that PC2 can access IP Network normally and PC1 cannot access IP Network.

Network Topology

Networking of combining ARP Check with DHCP Snooping

Figure 1-2 Networking of combining ARP Check with DHCP Snooping

Configuration Steps

Step 1: Configure the link type of the VLAN and port on Device.

#Create VLAN2.

Device#configure terminal
Device(config)#vlan 2
Device(config-vlan2)#exit

#Configure the link type of the port gigabitethernet0/1, gigabitethernet0/2, and gigabitethernet0/3 as Access, all permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet 0/1-0/3
Device(config-if-range)#switchport access vlan 2
Device(config-if-range)#exit

Step 2: Configure the DHCP Snooping function on Device.

#Enable the DHCP Snooping function and configure the port gigabitethernet0/2 as trust port.

Device(config)#dhcp-snooping
Device(config)#interface gigabitethernet 0/2
Device(config-if-gigabitethernet0/2)#dhcp-snooping trust
Device(config-if-gigabitethernet0/2)#exit

Step 3: Configure the ARP Check function on Device.

#Enable the ARP Check function on the port gigabitethernet0/1.

Device(config)#interface gigabitethernet 0/1
Device(config-if-gigabitethernet0/1)#arp-check enable
Device(config-if-gigabitethernet0/1)#exit

Step 4: Check the result.

#After PC2 gets the IP address successfully, view the DHCP Snooping dynamic entry on Device.

Device#show dhcp-snooping database  
        dhcp-snooping database: 
        database entries count:1 
        database entries delete time :300 
         	 
macAddr         ipAddr          transtion-id  vlan  interface leaseTime(s)  status      
0013.0100.0001	192.168.1.100   2             2     gi0/1     107990        active     
------

#View the ARP Check binding entry of the port gigabitethernet0/1.

Device#show arp-check interface gigabitethernet0/1 
--------------------ARP Check Table---------------
FLAG Codes: 
--------------------------------------------------
Interface-Name Status  MAC-Address    IP-Address     Rate PolicySource  SetHardware 
gi0/1          enable  0013.0100.0001 192.168.1.100  15   DHCPSP        active
total number: 1

#PC2 can access IP Network normally, but PC1 cannot.