Courseiva
SecurityInterface Config

ip arp inspection trust

Configures a switch interface as a trusted port for Dynamic ARP Inspection (DAI), allowing all ARP packets to bypass validation.

Definition: ip arp inspection trust is a Cisco IOS interface config command. Configures a switch interface as a trusted port for Dynamic ARP Inspection (DAI), allowing all ARP packets to bypass validation.

Overview

The `ip arp inspection trust` command is a critical tool in the Cisco switch security arsenal, specifically designed to enforce Dynamic ARP Inspection (DAI). DAI is a security feature that validates Address Resolution Protocol (ARP) packets in a network, preventing ARP spoofing and man-in-the-middle attacks. By default, all switch ports are untrusted for DAI, meaning ARP packets received on those ports are subject to validation against a DHCP snooping binding database or an ARP ACL.

However, in certain scenarios—such as connections to routers, other switches, or servers that legitimately send ARP replies—you must explicitly configure a port as trusted to bypass this validation. This command sets the interface to a trusted state, allowing all ARP packets (requests and replies) to pass through without inspection. The concept behind DAI is rooted in the fact that ARP has no authentication mechanism, making it easy for an attacker to impersonate another device by sending forged ARP replies.

DAI intercepts ARP packets on untrusted ports and verifies that the sender's MAC and IP addresses match entries in the DHCP snooping database (which maps IP addresses to MAC addresses on trusted ports). If no match is found, the packet is dropped. The `ip arp inspection trust` command is typically used on ports that connect to infrastructure devices like routers, Layer 3 switches, or DHCP servers, where ARP traffic is expected to be legitimate.

It is also used on ports connecting to other switches to avoid dropping valid ARP packets in a multi-switch environment. Without this command, all ARP packets on a VLAN with DAI enabled would be inspected, potentially causing connectivity issues if the DHCP snooping database is incomplete or if static IP addresses are used. The command is part of a broader security workflow that includes enabling DHCP snooping (to build the binding database), enabling DAI on VLANs, and optionally configuring ARP ACLs for static entries.

It is important to note that the `ip arp inspection trust` command is applied at the interface configuration mode and affects only that specific port. The command is available in IOS 12.2(52)SE and later, and it requires the switch to be in privileged EXEC mode (privilege level 15) to configure. The running configuration will show the command under the interface, and it can be verified with `show ip arp inspection interfaces`.

A common mistake is forgetting to configure trusted ports on uplinks, which can cause ARP packets from routers to be dropped, leading to network outages. Another pitfall is trusting ports that connect to end-user devices, which defeats the purpose of DAI. The command is straightforward but has significant implications for network security and connectivity.

In summary, `ip arp inspection trust` is a simple yet powerful command that designates a port as exempt from ARP inspection, ensuring that legitimate ARP traffic from trusted devices flows unimpeded while maintaining security on untrusted ports.

Syntax·Interface Config
ip arp inspection trust

When to Use This Command

  • Enable on uplink ports connecting to trusted routers or switches to avoid dropping legitimate ARP traffic.
  • Configure on ports connecting to DHCP servers to ensure ARP responses from the server are not inspected.
  • Use on ports where IP phones or other devices are known to send valid ARP packets that might otherwise be flagged as invalid.
  • Apply to trunk ports carrying multiple VLANs to prevent DAI from inspecting inter-VLAN ARP traffic.

Command Examples

Enable ARP inspection trust on an access port

interface GigabitEthernet0/1 ip arp inspection trust
Switch(config-if)#ip arp inspection trust
Switch(config-if)#

The command is entered without any output confirmation. The interface is now trusted, meaning all ARP packets received on this port will bypass DAI validation.

Verify trusted port status

show ip arp inspection interfaces GigabitEthernet0/1
Interface        Trust State     Rate (pps)    Burst Interval
---------        -----------     ----------    --------------
Gi0/1            Trusted         15            1

The Trust State column shows 'Trusted' for this interface. Rate and Burst Interval are default values for rate limiting, which still apply even on trusted ports.

Understanding the Output

The 'show ip arp inspection interfaces' command displays the trust state for each interface. The 'Trust State' column indicates whether the port is 'Trusted' or 'Untrusted'. Trusted ports bypass ARP packet validation, while untrusted ports are subject to DAI checks.

The 'Rate (pps)' and 'Burst Interval' columns show the rate limiting configuration, which applies to both trusted and untrusted ports. A trusted port should have a rate limit set appropriately to prevent DoS attacks, even though validation is skipped.

Configuration Scenarios

Configure a switch uplink port as trusted for DAI

A Layer 2 switch connects to a router via GigabitEthernet0/1. DAI is enabled on VLAN 10, but ARP packets from the router must be trusted to avoid being dropped.

Topology

Router(Gi0/0)---10.0.10.0/24---(Gi0/1)Switch

Steps

  1. 1.Step 1: Enter global configuration mode: Switch> enable
  2. 2.Step 2: Enter interface configuration mode for the uplink: Switch# configure terminal
  3. 3.Step 3: Configure the interface as trusted for DAI: Switch(config)# interface GigabitEthernet0/1
  4. 4.Step 4: Exit configuration mode: Switch(config-if)# ip arp inspection trust
  5. 5.Step 5: Verify the configuration: Switch(config-if)# end
Configuration
! Full IOS config block
Switch> enable
Switch# configure terminal
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# ip arp inspection trust
Switch(config-if)# end

Verify: Use 'show ip arp inspection interfaces GigabitEthernet0/1' to verify. Expected output: 'GigabitEthernet0/1 Trusted'

Watch out: If DAI is not enabled on the VLAN, the trust command has no effect. Ensure 'ip arp inspection vlan 10' is configured globally.

Configure a switch-to-switch trunk as trusted for DAI

Two switches are connected via a trunk port carrying multiple VLANs. DAI is enabled on several VLANs, and the trunk must be trusted to prevent ARP packets from being inspected on the inter-switch link.

Topology

Switch1(Gi0/1)---trunk---(Gi0/2)Switch2

Steps

  1. 1.Step 1: Enter global configuration mode on Switch1: Switch1> enable
  2. 2.Step 2: Enter interface configuration mode for the trunk: Switch1# configure terminal
  3. 3.Step 3: Configure the trunk port as trusted: Switch1(config)# interface GigabitEthernet0/1
  4. 4.Step 4: Exit configuration mode: Switch1(config-if)# ip arp inspection trust
  5. 5.Step 5: Repeat steps on Switch2 for its trunk port: Switch1(config-if)# end
  6. 6.Step 6: Verify on both switches: Switch2# configure terminal
  7. 7.Step 7: Switch2(config)# interface GigabitEthernet0/2
  8. 8.Step 8: Switch2(config-if)# ip arp inspection trust
  9. 9.Step 9: Switch2(config-if)# end
Configuration
! On Switch1
Switch1> enable
Switch1# configure terminal
Switch1(config)# interface GigabitEthernet0/1
Switch1(config-if)# ip arp inspection trust
Switch1(config-if)# end

! On Switch2
Switch2> enable
Switch2# configure terminal
Switch2(config)# interface GigabitEthernet0/2
Switch2(config-if)# ip arp inspection trust
Switch2(config-if)# end

Verify: Use 'show ip arp inspection interfaces' on both switches. Expected output shows both interfaces as 'Trusted'.

Watch out: If the trunk is not configured as trusted on both ends, ARP packets may be dropped in one direction, causing asymmetric connectivity issues.

Troubleshooting with This Command

When troubleshooting DAI-related issues, the `ip arp inspection trust` command is often a key suspect. The most common symptom is that devices on a VLAN with DAI enabled cannot communicate with devices connected to a router or another switch. For example, hosts may get DHCP addresses but cannot ping the default gateway.

This typically indicates that the uplink port to the router is not trusted. To diagnose, start by checking the DAI status on the VLAN: use `show ip arp inspection vlan <vlan-id>`. Healthy output shows 'ARP ACL: NONE' and 'DHCP snooping: Enabled' with a rate limit.

If the VLAN is enabled, check the interface trust state with `show ip arp inspection interfaces`. Look for the interface connecting to the router; if it shows 'Untrusted', that is likely the problem. Another indicator is the ARP inspection statistics: `show ip arp inspection statistics vlan <vlan-id>`.

If you see a high number of 'ACL Deny' or 'DHCP Deny' packets, it suggests ARP packets are being dropped. Specifically, 'DHCP Deny' means the sender's MAC-IP binding is not in the DHCP snooping database. For a trusted port, these counters should be zero for packets received on that port.

If the port is trusted but drops still occur, verify that DAI is actually enabled on the VLAN; if not, the trust command is ignored. Also, check if the DHCP snooping database is populated: `show ip dhcp snooping binding`. If the router has a static IP, you need to configure an ARP ACL to allow its ARP packets.

A step-by-step diagnostic flow: 1) Confirm DAI is enabled on the VLAN. 2) Identify the interface connecting to the trusted device. 3) Check the trust state of that interface. 4) If untrusted, configure it as trusted. 5) If already trusted, check ARP inspection statistics for drops. 6) If drops persist, verify DHCP snooping bindings or configure an ARP ACL. Correlate with `debug ip arp inspection` (use with caution in production) to see real-time ARP packet validation. The debug output shows whether packets are forwarded or dropped and the reason.

For example, 'ARP inspection: packet dropped on vlan 10, interface Gi0/1, reason: DHCP deny' indicates the sender's MAC-IP is not in the database. This points to either a missing DHCP binding or a need to trust the port. In summary, the trust command is often the first thing to check when DAI causes connectivity loss, and verifying the interface trust state is a quick win.

CCNA Exam Tips

1.

Remember that DAI is only effective on untrusted ports; trusted ports bypass validation, so only configure trust on ports that are absolutely reliable.

2.

The 'ip arp inspection trust' command is configured per interface and is disabled by default (all ports are untrusted).

3.

In the CCNA exam, you may be asked to identify which ports should be trusted: typically uplinks to other switches or routers, and ports connecting to DHCP servers.

4.

Trust state does not affect rate limiting; rate limiting is applied regardless of trust state.

Common Mistakes

Configuring trust on all ports, which defeats the purpose of DAI and leaves the network vulnerable to ARP spoofing.

Forgetting to configure trust on uplink ports, causing legitimate ARP traffic from upstream devices to be dropped.

Assuming that trusted ports do not need rate limiting; rate limiting should still be configured to prevent ARP storms.

ip arp inspection trust vs ip arp inspection vlan [id]

The `ip arp inspection trust` and `ip arp inspection vlan` commands are often confused because both are essential for configuring Dynamic ARP Inspection (DAI), but they operate at different levels—interface and VLAN, respectively. The trust command exempts a port from ARP validation, while the vlan command enables validation on all ports in specified VLANs.

Aspectip arp inspection trustip arp inspection vlan [id]
ScopePer-interfacePer-VLAN
Configuration modeInterface configurationGlobal configuration
Effect on ARP packetsBypasses DAI validationEnables DAI validation on all untrusted ports
PrecedenceOverrides VLAN-level DAI on that interfaceSets default validation state; trust command can override
Typical useMark uplinks to routers or other trusted switchesEnable DAI on VLANs with hosts to prevent ARP spoofing

Use ip arp inspection trust when you have a port that connects to a trusted device (e.g., router, another switch) that should not be subjected to ARP validation.

Use ip arp inspection vlan [id] when you want to enable ARP inspection on specific VLANs to protect endpoints from ARP spoofing attacks.

Platform Notes

In IOS-XE, the `ip arp inspection trust` command syntax and behavior are identical to classic IOS. The command is available in IOS-XE versions 3.2.0SE and later. On NX-OS, the equivalent functionality is provided by the `ip arp inspection trust` command as well, but it is configured under interface configuration mode with the same syntax.

However, NX-OS uses a different underlying mechanism: DAI relies on the DHCP snooping binding table, but NX-OS also supports ARP ACLs. The command is available in NX-OS versions 5.2(1) and later. For ASA devices, there is no direct equivalent because ASA does not perform Layer 2 ARP inspection; instead, it uses ARP inspection features like 'arp inspection' in transparent firewall mode, but the concept of trusted ports is not the same.

In IOS-XR, this command does not exist because IOS-XR is primarily a routing platform and does not support DAI. Between IOS versions, the command has remained consistent from 12.2(52)SE through 15.x and 16.x. One minor difference is that in some older IOS versions (12.2), the command might require the 'ip arp inspection' feature to be enabled globally first, while in later versions it can be configured independently but only takes effect when DAI is enabled on the VLAN.

Also, the output of `show ip arp inspection interfaces` may vary slightly in formatting across versions, but the trust state field is always present. In IOS-XE 16.x, the command is fully supported and behaves as expected. For multi-switch environments, ensure all switches in the path have consistent trust configurations to avoid ARP drops.

Related Commands

ip arp inspection vlan [id]

Enables Dynamic ARP Inspection (DAI) on specified VLANs to validate ARP packets and prevent ARP spoofing attacks.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions