WEBVTT

1
00:00.000 --> 00:00.970 align:middle line:84%


2
00:00.970 --> 00:01.970 align:middle line:84%
Welcome back.

3
00:01.970 --> 00:03.520 align:middle line:90%
In the previous
video, we took a look

4
00:03.520 --> 00:06.490 align:middle line:90%
at the syntax, the commands,
to implement and verify

5
00:06.490 --> 00:08.150 align:middle line:84%
dynamic ARP inspection.

6
00:08.150 --> 00:10.905 align:middle line:90%
And it's now time to put
those commands to work.

7
00:10.905 --> 00:12.280 align:middle line:90%
Let's take a look
at our diagram,

8
00:12.280 --> 00:13.970 align:middle line:84%
and then we'll go to the lab.

9
00:13.970 --> 00:14.840 align:middle line:84%
So here's our plan.

10
00:14.840 --> 00:17.650 align:middle line:90%
We're going to implement dynamic
ARP inspection for VLAN 30

11
00:17.650 --> 00:18.500 align:middle line:84%
on this switch.

12
00:18.500 --> 00:22.290 align:middle line:90%
And the command is IP,
ARP, inspection, VLAN 30.

13
00:22.290 --> 00:24.963 align:middle line:90%
And to set this interface,
3/3 is a trusted port.

14
00:24.963 --> 00:26.380 align:middle line:90%
We'd use the command
and interface

15
00:26.380 --> 00:30.020 align:middle line:90%
config on the switch, IP,
ARP, inspection, trust.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:26.380 --> 00:30.020 align:middle line:90%
config on the switch, IP,
ARP, inspection, trust.

16
00:30.020 --> 00:32.500 align:middle line:90%
Then we can verify our work
with the show, IP, ARP,

17
00:32.500 --> 00:34.640 align:middle line:84%
inspection for that VLAN.

18
00:34.640 --> 00:37.580 align:middle line:90%
And as we jump into the CLI,
I've got a question for you.

19
00:37.580 --> 00:39.520 align:middle line:90%
I know that dynamic
ARP inspection

20
00:39.520 --> 00:42.250 align:middle line:90%
is going to check the ARP
messages, just to make sure

21
00:42.250 --> 00:43.300 align:middle line:84%
that nobody is lying.

22
00:43.300 --> 00:46.690 align:middle line:90%
Well, it has to know what
the correct layer 3 and layer

23
00:46.690 --> 00:49.210 align:middle line:90%
2 combos are for
each of the hosts.

24
00:49.210 --> 00:50.950 align:middle line:90%
Do you recall where
it's going to look

25
00:50.950 --> 00:53.470 align:middle line:90%
to see whether or not the
layer 3 and layer 2 information

26
00:53.470 --> 00:55.030 align:middle line:84%
matches up?

27
00:55.030 --> 00:57.102 align:middle line:90%
What is the other source
of that information

28
00:57.102 --> 00:58.310 align:middle line:84%
that it's going to pull from?

29
00:58.310 --> 01:00.600 align:middle line:84%
Do you remember?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:58.310 --> 01:00.600 align:middle line:84%
Do you remember?

30
01:00.600 --> 01:03.640 align:middle line:90%
And if you're saying, Keith,
I think it was DHCP snooping,

31
01:03.640 --> 01:04.660 align:middle line:84%
you are right.

32
01:04.660 --> 01:06.827 align:middle line:90%
So the first thing we're
going to do before we start

33
01:06.827 --> 01:10.300 align:middle line:90%
configuring anything is, we want
to verify if DHCP snooping is

34
01:10.300 --> 01:13.930 align:middle line:90%
enabled and see if there's any
entries in the DHCP snooping

35
01:13.930 --> 01:17.620 align:middle line:90%
binding so that ARP inspection
has something to work with.

36
01:17.620 --> 01:18.630 align:middle line:84%
That's really important.

37
01:18.630 --> 01:20.088 align:middle line:90%
So let's take a
look at that first.

38
01:20.088 --> 01:24.310 align:middle line:90%
So here on the switch, let's
do a show IP DHCP snooping.

39
01:24.310 --> 01:27.190 align:middle line:90%
And we use the keyword
"binding" and press Enter.

40
01:27.190 --> 01:29.230 align:middle line:90%
And sure enough,
we've got two entries.

41
01:29.230 --> 01:30.490 align:middle line:84%
We're concerned with VLAN 30.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.230 --> 01:30.490 align:middle line:84%
We're concerned with VLAN 30.

42
01:30.490 --> 01:32.380 align:middle line:84%
So it knows at least one here.

43
01:32.380 --> 01:36.250 align:middle line:90%
This Mac address with this
IP address is on port gig 0

44
01:36.250 --> 01:37.780 align:middle line:84%
slash 1 in VLAN 30.

45
01:37.780 --> 01:40.150 align:middle line:90%
So once we enable
dynamic ARP inspection,

46
01:40.150 --> 01:42.370 align:middle line:90%
it can use this
entry here as a way

47
01:42.370 --> 01:44.680 align:middle line:90%
to check to see whether or
not the layer 3 and layer 2

48
01:44.680 --> 01:47.510 align:middle line:90%
information is correct
for our device.

49
01:47.510 --> 01:53.490 align:middle line:90%
We also should do a show IP
ARP inspection for VLAN 30,

50
01:53.490 --> 01:55.240 align:middle line:90%
just to make sure it's
not yet configured.

51
01:55.240 --> 01:56.590 align:middle line:90%
So that's a great
starting point for us.

52
01:56.590 --> 01:57.520 align:middle line:84%
It's not yet enabled.

53
01:57.520 --> 01:58.440 align:middle line:84%
So let's enable it.

54
01:58.440 --> 02:00.650 align:middle line:90%
We'll do a config T. And
I've got a question for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:58.440 --> 02:00.650 align:middle line:90%
We'll do a config T. And
I've got a question for you.

55
02:00.650 --> 02:03.220 align:middle line:90%
Let's go back to our
topology for a moment.

56
02:03.220 --> 02:06.100 align:middle line:90%
Should we make this a
trusted interface first,

57
02:06.100 --> 02:08.410 align:middle line:90%
before we enable the
feature for the VLAN?

58
02:08.410 --> 02:09.639 align:middle line:84%
I'm thinking we should.

59
02:09.639 --> 02:12.820 align:middle line:90%
Otherwise, we're going to
get errors anytime R3 does

60
02:12.820 --> 02:16.420 align:middle line:90%
ARP messages, because R3 does
not have a dynamically learned

61
02:16.420 --> 02:16.960 align:middle line:84%
address.

62
02:16.960 --> 02:19.870 align:middle line:90%
So it's not in the DHCP
snooping binding table.

63
02:19.870 --> 02:23.080 align:middle line:90%
So I would recommend we make
this 3/3 interface trusted

64
02:23.080 --> 02:27.250 align:middle line:90%
first, and then we enable the
ARP inspection on VLAN 30.

65
02:27.250 --> 02:30.850 align:middle line:90%
So we'll go to
interface gig 3/3.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:27.250 --> 02:30.850 align:middle line:90%
So we'll go to
interface gig 3/3.

66
02:30.850 --> 02:33.680 align:middle line:90%
And also, we should verify
that we're on the right port.

67
02:33.680 --> 02:36.520 align:middle line:90%
How do we know that interface
gig 3/3 here on the switch

68
02:36.520 --> 02:38.050 align:middle line:84%
connects out to R3?

69
02:38.050 --> 02:42.308 align:middle line:90%
And one way of doing that would
be a do show CDP neighbor.

70
02:42.308 --> 02:43.850 align:middle line:90%
And that's going to
verify it for us.

71
02:43.850 --> 02:47.260 align:middle line:90%
So our local interface gig
3/3 does indeed go to R3.

72
02:47.260 --> 02:47.890 align:middle line:84%
Fantastic.

73
02:47.890 --> 02:52.720 align:middle line:90%
So here, we'll do an IP ARP
inspection question mark

74
02:52.720 --> 02:54.910 align:middle line:84%
and trust, and press Enter.

75
02:54.910 --> 02:56.410 align:middle line:90%
And then we'll
enable ARP inspection

76
02:56.410 --> 02:57.700 align:middle line:84%
for the VLAN with IP.

77
02:57.700 --> 03:02.903 align:middle line:90%
ARP inspection for VLAN
and 30, and press Enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:57.700 --> 03:02.903 align:middle line:90%
ARP inspection for VLAN
and 30, and press Enter.

78
03:02.903 --> 03:04.070 align:middle line:84%
And then we'll type it, end.

79
03:04.070 --> 03:09.730 align:middle line:90%
And we'll do a show IP ARP
inspection for VLAN 30.

80
03:09.730 --> 03:11.840 align:middle line:84%
Press Enter.

81
03:11.840 --> 03:13.230 align:middle line:84%
And check this out.

82
03:13.230 --> 03:15.292 align:middle line:90%
We have a lot activity
going on here.

83
03:15.292 --> 03:17.000 align:middle line:90%
So we have a lot of
denies going on here.

84
03:17.000 --> 03:19.558 align:middle line:90%
And they're all
coming in on gig 0/1.

85
03:19.558 --> 03:20.600 align:middle line:84%
Look at the IP addresses.

86
03:20.600 --> 03:26.420 align:middle line:90%
We have 10.1.0.111
and 10.1.0.120.

87
03:26.420 --> 03:28.265 align:middle line:90%
Let's talk about why
that's happening.

88
03:28.265 --> 03:29.390 align:middle line:84%
And here's what's going on.

89
03:29.390 --> 03:32.060 align:middle line:90%
Off of this one port, I've
got some other devices
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:29.390 --> 03:32.060 align:middle line:90%
Off of this one port, I've
got some other devices

90
03:32.060 --> 03:34.110 align:middle line:84%
on the 10.1 network.

91
03:34.110 --> 03:36.740 align:middle line:90%
So although it's one
broadcast domain down here,

92
03:36.740 --> 03:38.870 align:middle line:90%
I've got different
devices, thinking

93
03:38.870 --> 03:39.860 align:middle line:84%
it's different subnets.

94
03:39.860 --> 03:41.910 align:middle line:90%
So I've got some
devices on 10.1.0

95
03:41.910 --> 03:43.313 align:middle line:84%
that are sending ARP messages.

96
03:43.313 --> 03:45.230 align:middle line:90%
And they're working their
way up to this port,

97
03:45.230 --> 03:46.563 align:middle line:84%
because they're broadcast-based.

98
03:46.563 --> 03:47.960 align:middle line:90%
And the switch is
saying, nope, I

99
03:47.960 --> 03:51.950 align:middle line:90%
don't have any information in
the DHCP snooping table that

100
03:51.950 --> 03:56.230 align:middle line:90%
says this specific IP address
of dot 111, or whatever it was,

101
03:56.230 --> 03:58.653 align:middle line:90%
and because I can't verify
it, because I don't know,

102
03:58.653 --> 03:59.570 align:middle line:84%
I'm going to drop you.

103
03:59.570 --> 04:01.028 align:middle line:90%
And that's what
those messages are.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:59.570 --> 04:01.028 align:middle line:90%
And that's what
those messages are.

104
04:01.028 --> 04:03.440 align:middle line:90%
So what we've done is,
we've applied ARP inspection

105
04:03.440 --> 04:04.700 align:middle line:84%
for VLAN 30.

106
04:04.700 --> 04:07.130 align:middle line:84%
We made 3/3 a trusted port.

107
04:07.130 --> 04:09.870 align:middle line:90%
We also did a Show command to
verify that it's configured.

108
04:09.870 --> 04:14.090 align:middle line:90%
But now our challenge is,
we've got some ARP messages

109
04:14.090 --> 04:16.160 align:middle line:90%
from other devices
off of this port

110
04:16.160 --> 04:19.810 align:middle line:90%
down here that are being
denied on this switch port.

111
04:19.810 --> 04:22.310 align:middle line:90%
And that provides a perfect
segue for the next video,

112
04:22.310 --> 04:24.710 align:middle line:90%
because the next video and
lab, what we're going to do

113
04:24.710 --> 04:27.710 align:middle line:90%
is, we're going to take devices
that are not being learned

114
04:27.710 --> 04:31.700 align:middle line:90%
via DHCP snooping and create
static entries that basically
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:27.710 --> 04:31.700 align:middle line:90%
via DHCP snooping and create
static entries that basically

115
04:31.700 --> 04:34.380 align:middle line:90%
tell us the switch, you
know what, this IP address

116
04:34.380 --> 04:36.470 align:middle line:90%
and this layer 2
address, they match up.

117
04:36.470 --> 04:38.030 align:middle line:90%
Go ahead and use
it, even if it's not

118
04:38.030 --> 04:40.400 align:middle line:84%
in the DHCP snooping table.

119
04:40.400 --> 04:43.280 align:middle line:90%
And as a result, by looking at
that list and saying, oh, yep,

120
04:43.280 --> 04:45.590 align:middle line:90%
these match, the
dynamic ARP inspection

121
04:45.590 --> 04:48.410 align:middle line:90%
can check on ARP messages,
even though they haven't

122
04:48.410 --> 04:50.340 align:middle line:84%
been learned via DHCP snooping.

123
04:50.340 --> 04:53.862 align:middle line:90%
So we'll do that with a ARP
ACL in the very next video.

124
04:53.862 --> 04:55.320 align:middle line:90%
So I'll see there
in just a moment.

125
04:55.320 --> 04:57.710 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

126
04:57.710 --> 05:00.940 align:middle line:90%
And I'd like to thank
you for viewing.