ip arp inspection vlan [id]
Enables Dynamic ARP Inspection (DAI) on specified VLANs to validate ARP packets and prevent ARP spoofing attacks.
Definition: ip arp inspection vlan [id] is a Cisco IOS global config command. Enables Dynamic ARP Inspection (DAI) on specified VLANs to validate ARP packets and prevent ARP spoofing attacks.
Overview
The `ip arp inspection vlan [id]` command is a critical security feature in Cisco IOS that enables Dynamic ARP Inspection (DAI) on specified VLANs. ARP spoofing (or ARP poisoning) is a common attack where a malicious device sends forged ARP messages to associate its MAC address with the IP address of a legitimate host (such as the default gateway). This allows the attacker to intercept, modify, or drop traffic, leading to man-in-the-middle attacks, denial of service, or data theft.
DAI mitigates this by intercepting all ARP packets on the VLAN and validating them against a trusted database of IP-to-MAC bindings, typically sourced from DHCP snooping. Only ARP packets that match a valid binding are forwarded; invalid packets are dropped and optionally logged. This command is essential in any switched network where security is a concern, especially in multi-tenant environments, campus networks, or any segment with untrusted hosts.
You would reach for this command when you need to enforce ARP integrity on a per-VLAN basis, typically after enabling DHCP snooping (which populates the binding database). Alternatives include manual ACLs or port security, but these are less dynamic and harder to maintain. DAI integrates seamlessly with DHCP snooping and IP Source Guard, forming a layered defense against IP spoofing.
In terms of IOS behavior, the command is executed in global configuration mode and requires privilege level 15. The effect is immediate on the running configuration; the switch begins validating ARP packets on the specified VLAN. The command does not buffer output; it directly modifies the switch's behavior.
It is important to note that DAI relies on a trusted binding database; without DHCP snooping, you must manually configure static bindings using `arp access-list` and `ip arp inspection filter`. Also, DAI is only effective on VLANs where the switch is the Layer 2 boundary; it does not inspect ARP packets on routed interfaces. The command can be applied to multiple VLANs in a single line (e.g., `ip arp inspection vlan 10,20,30`) or a range (e.g., `ip arp inspection vlan 10-20`).
By default, DAI is disabled on all VLANs. Enabling it on a VLAN without a valid binding source will cause all ARP packets to be dropped, potentially disrupting network connectivity. Therefore, careful planning and testing are required before deployment.
This command is a cornerstone of Cisco's security portfolio for campus networks and is extensively tested in CCNA and CCNP exams.
ip arp inspection vlan [id]When to Use This Command
- Securing a network with multiple VLANs against man-in-the-middle attacks by validating ARP packets.
- Enforcing IP-to-MAC address bindings in a DHCP environment to prevent unauthorized devices from intercepting traffic.
- Protecting a guest VLAN from ARP spoofing where untrusted devices may attempt to impersonate the default gateway.
- Compliance requirement for PCI DSS or other security standards that mandate ARP inspection in switched networks.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| id | <1-4094> or range (e.g., 10-20) or comma-separated list (e.g., 10,20,30) | Specifies the VLAN ID(s) on which to enable Dynamic ARP Inspection. Valid values are from 1 to 4094, but only VLANs that exist on the switch can be configured. Common mistakes include using a VLAN that is not created or applying to a VLAN that already has DAI enabled, which results in no change. Also, using a range that includes reserved VLANs (like 1002-1005) may cause errors. |
Command Examples
Enable DAI on VLAN 10
ip arp inspection vlan 10No output is generated on success. Use 'show ip arp inspection vlan 10' to verify.
Enable DAI on multiple VLANs
ip arp inspection vlan 10,20,30Enables DAI on VLANs 10, 20, and 30. Verify with 'show ip arp inspection'.
Understanding the Output
The 'ip arp inspection vlan' command itself produces no output. To verify DAI status, use 'show ip arp inspection vlan [id]'. The output shows VLAN ID, operational state (Enabled/Disabled), ACL match, and DHCP snooping validation.
Key fields: 'Vlan' – VLAN number; 'Configuration' – configured state; 'Operation' – actual state (must be Enabled); 'ACL Match' – whether ACL is applied; 'DHCP Snooping' – whether DHCP snooping bindings are used. A healthy network shows 'Enabled' for all configured VLANs. If 'Operation' shows 'Disabled', check that DHCP snooping is enabled globally and on the VLAN.
Watch for 'Invalid' packets in 'show ip arp inspection statistics' which indicate ARP attacks or misconfigurations.
Configuration Scenarios
Enable DAI on a single VLAN with DHCP snooping
A small office network with a single VLAN 10. DHCP snooping is already enabled to build the binding database. The goal is to prevent ARP spoofing attacks from rogue devices.
Topology
Switch(S1)---(Gi0/1)PC1 (DHCP client)
Switch(S1)---(Gi0/2)Attacker (rogue)Steps
- 1.Step 1: Enter global configuration mode: Switch# configure terminal
- 2.Step 2: Enable DHCP snooping globally: Switch(config)# ip dhcp snooping
- 3.Step 3: Enable DHCP snooping on VLAN 10: Switch(config)# ip dhcp snooping vlan 10
- 4.Step 4: Enable DAI on VLAN 10: Switch(config)# ip arp inspection vlan 10
- 5.Step 5: (Optional) Configure trusted ports (uplink to router): Switch(config)# interface gigabitethernet 0/24
- 6.Step 6: (Optional) Set port as trusted: Switch(config-if)# ip arp inspection trust
- 7.Step 7: Exit and verify: Switch(config-if)# end
! Switch# configure terminal Switch(config)# ip dhcp snooping Switch(config)# ip dhcp snooping vlan 10 Switch(config)# ip arp inspection vlan 10 Switch(config)# interface gigabitethernet 0/24 Switch(config-if)# ip arp inspection trust Switch(config-if)# end
Verify: Use 'show ip arp inspection interfaces' to verify that DAI is enabled on VLAN 10 and that the uplink port is trusted. Use 'show ip arp inspection statistics' to see ARP packet counts. Expected output: VLAN 10 shows 'Enabled', and trusted port shows 'Trusted'.
Watch out: If DHCP snooping is not enabled on the VLAN, DAI will drop all ARP packets because the binding database is empty. Always ensure DHCP snooping is configured first, or use an ARP ACL to define static bindings.
Enable DAI on multiple VLANs with static bindings
A network with VLANs 100 and 200 where some devices use static IP addresses. DHCP snooping is not used. Static ARP ACLs must be configured to provide valid bindings for DAI.
Topology
Switch(S1)---(Gi0/1)Server (static IP 192.168.100.10)
Switch(S1)---(Gi0/2)Printer (static IP 192.168.200.20)Steps
- 1.Step 1: Enter global configuration mode: Switch# configure terminal
- 2.Step 2: Create an ARP ACL for VLAN 100: Switch(config)# arp access-list STATIC_VLAN100
- 3.Step 3: Permit the static binding: Switch(config-arp-nacl)# permit ip host 192.168.100.10 mac host 0050.7966.6800
- 4.Step 4: Exit ACL configuration: Switch(config-arp-nacl)# exit
- 5.Step 5: Create an ARP ACL for VLAN 200: Switch(config)# arp access-list STATIC_VLAN200
- 6.Step 6: Permit the static binding: Switch(config-arp-nacl)# permit ip host 192.168.200.20 mac host 0050.7966.6801
- 7.Step 7: Exit ACL configuration: Switch(config-arp-nacl)# exit
- 8.Step 8: Apply the ACL to VLAN 100: Switch(config)# ip arp inspection filter STATIC_VLAN100 vlan 100
- 9.Step 9: Apply the ACL to VLAN 200: Switch(config)# ip arp inspection filter STATIC_VLAN200 vlan 200
- 10.Step 10: Enable DAI on both VLANs: Switch(config)# ip arp inspection vlan 100,200
- 11.Step 11: Exit and verify: Switch(config)# end
! Switch# configure terminal Switch(config)# arp access-list STATIC_VLAN100 Switch(config-arp-nacl)# permit ip host 192.168.100.10 mac host 0050.7966.6800 Switch(config-arp-nacl)# exit Switch(config)# arp access-list STATIC_VLAN200 Switch(config-arp-nacl)# permit ip host 192.168.200.20 mac host 0050.7966.6801 Switch(config-arp-nacl)# exit Switch(config)# ip arp inspection filter STATIC_VLAN100 vlan 100 Switch(config)# ip arp inspection filter STATIC_VLAN200 vlan 200 Switch(config)# ip arp inspection vlan 100,200 Switch(config)# end
Verify: Use 'show ip arp inspection vlan 100' to verify that DAI is enabled and the filter is applied. Use 'show ip arp inspection statistics vlan 100' to see ACL matches. Expected output: VLAN 100 shows 'Enabled', filter 'STATIC_VLAN100' is active.
Watch out: Static ARP ACLs are order-sensitive; the first match wins. If no permit entry matches, the packet is dropped. Ensure you have a permit entry for every valid host, or use a 'deny ip any any' at the end (implicit deny exists). Also, the MAC address must be in the format H.H.H (e.g., 0050.7966.6800).
Troubleshooting with This Command
When troubleshooting DAI, the primary command is 'show ip arp inspection interfaces' to verify DAI status on VLANs and trust state on ports. Healthy output shows DAI enabled on the desired VLANs and trusted ports correctly identified. Problem indicators include DAI disabled on a VLAN where it should be enabled, or all ports showing as untrusted (which is normal for access ports, but uplinks should be trusted).
Another key command is 'show ip arp inspection statistics' which displays counts of ARP packets received, processed, dropped, and ACL matches. A healthy network should have few or no drops. A high number of drops indicates ARP spoofing attempts or misconfiguration.
Focus on the 'Drops' field; if it is non-zero, investigate the source. Use 'show ip arp inspection vlan [id]' to see detailed per-VLAN statistics and filter information. Common symptoms that DAI helps diagnose include intermittent connectivity, duplicate IP address warnings, or hosts unable to reach the default gateway.
These often point to ARP spoofing. The diagnostic flow: 1) Check DAI status with 'show ip arp inspection vlan [id]' to ensure it is enabled. 2) Check port trust with 'show ip arp inspection interfaces' to ensure uplinks are trusted. 3) Examine statistics with 'show ip arp inspection statistics' to see if drops are occurring. 4) If drops exist, use 'debug ip arp inspection' to see which packets are being dropped (caution: this can be CPU-intensive). 5) Correlate with DHCP snooping bindings using 'show ip dhcp snooping binding' to ensure valid bindings exist. If bindings are missing, DHCP snooping may not be enabled on the VLAN. 6) If using static ACLs, verify the ACL with 'show arp access-list' to ensure entries are correct. 7) Check the log for DAI messages using 'show logging' or 'show ip arp inspection log'.
DAI logs dropped packets by default. The log shows the source MAC, source IP, VLAN, and port. This helps identify the offending device.
Correlate DAI drops with 'show mac address-table' to find the switch port of the attacker. Also, use 'show ip arp inspection interfaces' to see if any ports are in 'invalid' state. DAI can also be used in conjunction with 'ip source guard' to provide additional IP spoofing protection.
In summary, DAI troubleshooting revolves around verifying the binding database, trust configuration, and ACLs, then analyzing drop statistics and logs to pinpoint the source of invalid ARP packets.
CCNA Exam Tips
CCNA exam tip: DAI requires DHCP snooping to be enabled globally and on the VLAN; otherwise, DAI will not validate ARP packets.
CCNA exam tip: DAI can be configured with ACLs to allow static IP-MAC bindings; know the 'ip arp inspection filter' command.
CCNA exam tip: DAI validates ARP packets based on MAC address, IP address, and interface; invalid packets are dropped and logged.
CCNA exam tip: DAI is typically enabled on access VLANs, not trunk ports; trunk ports are considered trusted by default.
Common Mistakes
Mistake 1: Enabling DAI without DHCP snooping – DAI will not validate ARP packets, leading to false security.
Mistake 2: Forgetting to configure trusted ports – all ports are untrusted by default; trunk ports to other switches must be trusted to avoid dropping legitimate ARP.
Mistake 3: Not configuring a rate limit – DAI can cause high CPU usage if ARP storms occur; use 'ip arp inspection limit' to prevent DoS.
ip arp inspection vlan [id] vs ip dhcp snooping
Both 'ip arp inspection vlan' and 'ip dhcp snooping' are security features that protect against spoofing attacks, but they operate at different layers and have distinct scopes. They are often confused because Dynamic ARP Inspection (DAI) relies on DHCP snooping bindings to validate ARP packets, leading to their association in network security configurations.
| Aspect | ip arp inspection vlan [id] | ip dhcp snooping |
|---|---|---|
| Scope | VLAN-specific; only applies to specified VLANs | Global; affects all VLANs or can be restricted per VLAN |
| Configuration mode | Global configuration for VLAN-level enabling | Global configuration for switch-wide feature |
| Persistence | Operates only after DHCP snooping is enabled and binding table is built | Creates a binding table used by DAI; must be enabled first for DAI to function |
| Precedence | Relies on DHCP snooping; not effective without it | Foundation for DAI; usually configured before 'ip arp inspection' |
| Typical use | Prevent ARP spoofing by validating sender MAC/IP in ARP packets | Prevent rogue DHCP servers and build IP-to-MAC bindings |
Use ip arp inspection vlan [id] when you need to validate ARP packets on specific VLANs to prevent man-in-the-middle attacks, ensuring DHCP snooping is already active.
Use ip dhcp snooping when you need to globally filter untrusted DHCP messages and build a binding database that supports Dynamic ARP Inspection and IP Source Guard.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850/9300), the command syntax is identical: 'ip arp inspection vlan [id]'. However, the output format of 'show ip arp inspection' may differ slightly, with additional fields like 'Vlan Configuration' and 'Operational Status'. The underlying behavior is the same.
In NX-OS (e.g., Nexus 9000), the equivalent command is 'ip arp inspection vlan [id]' as well, but the configuration context is different: it is entered in 'configure terminal' mode, and the feature must be enabled first with 'feature dhcp' and 'ip arp inspection'. NX-OS also uses 'ip arp inspection trust' on interfaces. There is no direct ASA equivalent; ASAs use ARP inspection via 'arp inspection' command in interface configuration mode, but it is not VLAN-based.
In IOS-XR (e.g., ASR 9000), DAI is not supported; instead, use 'arp security' or 'ipv4 arp security' commands. For older IOS versions (12.x), DAI was introduced in 12.2(25)SEA; earlier versions do not support it. In 15.x and 16.x, the command remains consistent.
One key difference: in some IOS versions, the 'ip arp inspection vlan' command may require the 'ip dhcp snooping' feature to be enabled globally, otherwise it will be rejected. Also, on some platforms, DAI is only supported on switches with hardware support for ARP inspection; on low-end switches, it may be software-processed, impacting performance. Always check platform documentation for specific limitations.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions