Courseiva
SecurityGlobal Config

ip arp inspection validate src-mac dst-mac ip

Enable validation of source MAC, destination MAC, and IP addresses in ARP packets to prevent ARP spoofing attacks on trusted ports.

Definition: ip arp inspection validate src-mac dst-mac ip is a Cisco IOS global config command. Enable validation of source MAC, destination MAC, and IP addresses in ARP packets to prevent ARP spoofing attacks on trusted ports.

Overview

The `ip arp inspection validate src-mac dst-mac ip` command is a critical security feature used to mitigate ARP spoofing attacks in switched networks. ARP (Address Resolution Protocol) is fundamental for mapping IP addresses to MAC addresses, but it lacks authentication, making it vulnerable to spoofing where an attacker sends forged ARP messages to intercept traffic. This command, part of Dynamic ARP Inspection (DAI), validates the source MAC, destination MAC, and IP addresses in ARP packets on untrusted ports.

It ensures that the source MAC address in the Ethernet frame matches the sender MAC in the ARP body, the destination MAC matches the target MAC (for ARP replies), and the IP addresses are consistent with the DHCP snooping binding table. DAI is typically deployed on access ports where hosts connect, while trunk ports to other switches are trusted. This command is used when you need to enforce strict validation of all three fields; alternatively, you might use `ip arp inspection validate src-mac` or `ip arp inspection validate dst-mac` for partial validation.

It fits into a broader security workflow that includes DHCP snooping (to build the binding database) and IP Source Guard. The command is executed in global configuration mode and requires privilege level 15. It immediately affects the running configuration; no buffered output is generated.

DAI can cause CPU load on the switch if many ARP packets are inspected, so it should be applied judiciously. Understanding this command is essential for CCNA and CCNP candidates to secure Layer 2 networks against man-in-the-middle attacks.

Syntax·Global Config
ip arp inspection validate src-mac dst-mac ip

When to Use This Command

  • Prevent ARP cache poisoning by validating that the source MAC in the Ethernet header matches the sender MAC in the ARP body on a trusted port.
  • Ensure that the destination MAC in the Ethernet header matches the target MAC in the ARP body for ARP replies.
  • Validate that the IP addresses in ARP packets are not invalid (e.g., broadcast or multicast addresses) to block malformed ARP packets.
  • Use in combination with DHCP snooping to enforce IP-to-MAC binding consistency.

Parameters

ParameterSyntaxDescription
src-macsrc-macEnables validation of the source MAC address in the Ethernet frame against the sender MAC address in the ARP body. If they do not match, the packet is dropped. This prevents an attacker from sending an ARP packet with a spoofed sender MAC.
dst-macdst-macEnables validation of the destination MAC address in the Ethernet frame against the target MAC address in the ARP body (for ARP replies). For ARP requests, the destination MAC is the broadcast address, so this check is skipped. Mismatches indicate spoofing.
ipipEnables validation of the IP addresses in the ARP packet against the DHCP snooping binding table. The sender IP (for requests) and target IP (for replies) must match a valid binding. If no binding exists, the packet is dropped unless the port is trusted.

Command Examples

Enable full ARP inspection validation globally

ip arp inspection validate src-mac dst-mac ip

No output is generated upon successful configuration. The command enables all three validation checks: source MAC, destination MAC, and IP address validation.

Verify ARP inspection validation settings

show ip arp inspection
Source MAC Validation : Enabled
Destination MAC Validation : Enabled
IP Address Validation : Enabled

Vlan     Configuration    Operation   ACL Match          Static ACL
----    --------------    ---------   ---------          ----------
1       Enabled           Active      
10      Enabled           Active      
20      Disabled          Inactive    

Vlan     ACL Logging      DHCP Snooping
----    --------------    ---------------
1       Deny              Enabled
10       Deny              Enabled
20       Deny              Disabled

The first three lines show the validation status for each check type. The table shows per-VLAN ARP inspection status: 'Configuration' is the configured state, 'Operation' is the actual operational state (Active/Inactive). 'ACL Match' shows if an ACL is applied. 'Static ACL' shows if a static ACL is used. 'ACL Logging' shows logging action. 'DHCP Snooping' indicates whether DHCP snooping is enabled on the VLAN.

Understanding the Output

The 'show ip arp inspection' command displays the validation status for source MAC, destination MAC, and IP address. Each should show 'Enabled' if configured. The per-VLAN table shows the configured and operational state; 'Active' means ARP inspection is running on that VLAN.

'ACL Match' indicates if an ACL is applied to filter ARP packets. 'Static ACL' shows if a static ACL is used instead of DHCP snooping. 'ACL Logging' shows the logging action (Deny/Log).

'DHCP Snooping' indicates if DHCP snooping is enabled on the VLAN, which is required for dynamic ARP inspection to work. If a VLAN shows 'Inactive', check that DHCP snooping is enabled and that the VLAN is not shutdown.

Configuration Scenarios

Enable Full ARP Inspection Validation on Access Ports

A campus network has users connected to access switches. To prevent ARP spoofing attacks, the network administrator wants to validate source MAC, destination MAC, and IP addresses on all untrusted ports. DHCP snooping is already configured.

Topology

Switch1(Gi0/1)---PC1 Switch1(Gi0/2)---PC2 Switch1(Gi0/24)---Trunk to Core

Steps

  1. 1.Step 1: Enable DHCP snooping globally: Switch(config)# ip dhcp snooping
  2. 2.Step 2: Enable DHCP snooping on VLANs: Switch(config)# ip dhcp snooping vlan 10,20
  3. 3.Step 3: Configure trunk port as trusted: Switch(config)# interface GigabitEthernet0/24
  4. 4.Step 4: Switch(config-if)# ip dhcp snooping trust
  5. 5.Step 5: Switch(config-if)# exit
  6. 6.Step 6: Enable ARP inspection globally: Switch(config)# ip arp inspection vlan 10,20
  7. 7.Step 7: Enable full validation: Switch(config)# ip arp inspection validate src-mac dst-mac ip
Configuration
! Full IOS config block
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10,20
Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# exit
Switch(config)# ip arp inspection vlan 10,20
Switch(config)# ip arp inspection validate src-mac dst-mac ip

Verify: Use 'show ip arp inspection interfaces' to verify that validation is enabled. Expected output shows 'Src MAC Validation : Enabled', 'Dst MAC Validation : Enabled', 'IP Validation : Enabled' for each interface.

Watch out: If DHCP snooping is not enabled or the VLAN is not specified, ARP inspection will drop all ARP packets because no bindings exist. Always ensure DHCP snooping is configured for the same VLANs.

Troubleshoot ARP Inspection Drops Due to Validation Failure

Users report intermittent connectivity issues. The network engineer suspects ARP inspection is dropping legitimate packets. They need to verify the validation settings and check for dropped packets.

Topology

Switch1(Gi0/1)---PC1 (10.0.10.5) Switch1(Gi0/2)---PC2 (10.0.10.6) Switch1(Gi0/24)---Router

Steps

  1. 1.Step 1: Check ARP inspection statistics: Switch# show ip arp inspection statistics
  2. 2.Step 2: Check interface validation settings: Switch# show ip arp inspection interfaces
  3. 3.Step 3: Verify DHCP snooping bindings: Switch# show ip dhcp snooping binding
  4. 4.Step 4: If drops are seen, disable validation temporarily to isolate: Switch(config)# no ip arp inspection validate src-mac dst-mac ip
  5. 5.Step 5: Re-enable validation one parameter at a time: Switch(config)# ip arp inspection validate src-mac
  6. 6.Step 6: Monitor drops after each addition: Switch# show ip arp inspection statistics
Configuration
! Commands to troubleshoot
Switch# show ip arp inspection statistics
Switch# show ip arp inspection interfaces
Switch# show ip dhcp snooping binding
Switch(config)# no ip arp inspection validate src-mac dst-mac ip
Switch(config)# ip arp inspection validate src-mac

Verify: Use 'show ip arp inspection statistics' to see the number of dropped packets per VLAN. A healthy network should have zero drops. If drops appear, check the 'ACL Deny' or 'DHCP Deny' counters.

Watch out: When troubleshooting, remember that the 'ip' validation requires DHCP snooping bindings. Static IP hosts will have their ARP packets dropped unless you configure an ARP ACL or set the port as trusted. Use 'ip arp inspection filter' to allow static IPs.

Troubleshooting with This Command

When using `ip arp inspection validate src-mac dst-mac ip` for troubleshooting, the primary tool is `show ip arp inspection statistics`. Healthy output shows zero dropped packets across all VLANs. If drops are present, examine the 'DHCP Deny' counter: this indicates that the IP address in the ARP packet does not match any DHCP snooping binding.

Common causes include static IP hosts, misconfigured DHCP scopes, or expired leases. The 'ACL Deny' counter indicates that an ARP ACL blocked the packet. The 'Source MAC Deny' and 'Destination MAC Deny' counters indicate validation failures for MAC addresses.

Focus on the VLAN with the most drops. Use `show ip arp inspection interfaces` to verify that the port is untrusted (default) and that validation is enabled. If a port is trusted, ARP inspection is bypassed.

To correlate with DHCP snooping, use `show ip dhcp snooping binding` to see the IP-to-MAC mappings. If a legitimate host is being dropped, check if its IP is in the binding table. For static hosts, configure an ARP ACL: `arp access-list STATIC_HOSTS permit ip host 10.0.10.5 mac host 0050.7966.6800` and apply it with `ip arp inspection filter STATIC_HOSTS vlan 10`.

Another useful command is `debug ip arp inspection` (use with caution in production) to see real-time validation decisions. The debug output shows whether each ARP packet is forwarded or dropped and the reason. For example, 'DAI: Packet dropped: src MAC mismatch' indicates a source MAC validation failure.

Correlate this with the actual MAC addresses in the packet to identify spoofing or misconfiguration. If the network uses static IPs extensively, consider disabling the 'ip' validation or trusting the port. However, trusting a port disables all ARP inspection on that port, so it should be limited to ports connecting to routers or other switches.

A step-by-step diagnostic flow: 1) Identify affected VLANs from user reports. 2) Check `show ip arp inspection statistics` for drops. 3) If drops exist, check `show ip arp inspection interfaces` to ensure ports are untrusted. 4) Examine `show ip dhcp snooping binding` for missing entries. 5) For static hosts, create ARP ACLs. 6) If drops persist, enable debug to capture specific packets. 7) After changes, verify drops decrease. Remember that ARP inspection is CPU-intensive; excessive drops may indicate an attack or misconfiguration. Always correlate with `show ip arp inspection log` to see recent dropped packets.

CCNA Exam Tips

1.

CCNA 200-301: ARP inspection validation must be enabled globally; the command 'ip arp inspection validate src-mac dst-mac ip' enables all three checks at once.

2.

CCNA 200-301: ARP inspection only works on VLANs where DHCP snooping is enabled; without DHCP snooping, you must use static ACLs.

3.

CCNA 200-301: The 'show ip arp inspection' command shows per-VLAN status; look for 'Active' to confirm it's working.

4.

CCNA 200-301: Remember that ARP inspection validates only on trusted ports; untrusted ports are where validation occurs.

Common Mistakes

Mistake 1: Enabling ARP inspection without DHCP snooping on the VLAN, causing the operation to remain 'Inactive'.

Mistake 2: Forgetting to configure the 'ip arp inspection validate' command globally, so no validation checks are performed even if ARP inspection is enabled per VLAN.

Mistake 3: Applying ARP inspection to a VLAN that has no trusted ports defined, causing all ARP packets to be dropped.

ip arp inspection validate src-mac dst-mac ip vs ip arp inspection vlan [id]

Both commands are part of Dynamic ARP Inspection (DAI) configuration, but they serve distinct roles: 'ip arp inspection vlan' enables DAI on specified VLANs, while 'ip arp inspection validate' defines the set of fields (source MAC, destination MAC, IP) that are validated in ARP packets on trusted ports. They are often confused because enabling DAI without specifying validation may lead to incomplete protection, and administrators may not realize validation is a separate step.

Aspectip arp inspection validate src-mac dst-mac ipip arp inspection vlan [id]
ScopeGlobal configuration (affects all DAI-enabled VLANs)Global configuration but applies to specific VLANs
PurposeSpecify which ARP fields are validated on trusted portsEnable DAI processing on a VLAN
DependencyRequires DAI enabled on at least one VLAN via 'ip arp inspection vlan' to take effectNone, but typically used with validation settings
Effect on ARP packetsCauses DAI to check the specified fields in ARP packets received on trusted portsInitiates DAI inspection on all untrusted ports in the VLAN
Typical configuration orderConfigured after enabling DAI on VLANsConfigured first to enable DAI on VLANs

Use ip arp inspection validate src-mac dst-mac ip when you need to specify that DAI should verify both MAC addresses and IP address consistency in ARP packets on trusted ports.

Use ip arp inspection vlan [id] when you want to enable DAI on specific VLANs to protect against ARP spoofing attacks on untrusted ports.

Platform Notes

On Cisco IOS-XE (e.g., Catalyst 3650, 9300), the command syntax is identical to classic IOS. However, the output of `show ip arp inspection statistics` may include additional fields like 'Total Drops' and 'VLAN Drops'. On NX-OS (e.g., Nexus 9000), the equivalent feature is Dynamic ARP Inspection (DAI) but the command differs: `ip arp inspection validate src-mac dst-mac ip` is not supported; instead, use `ip arp inspection filter` and `ip arp inspection trust` on interfaces.

NX-OS uses `ip arp inspection validate` only with `src-mac` or `dst-mac` separately, and IP validation is done via DHCP snooping automatically. For ASA firewalls, ARP inspection is not directly applicable; instead, use ARP spoofing protection via `arp inspection` in transparent firewall mode. On IOS-XR (e.g., ASR 9000), the command does not exist; ARP inspection is not a feature in IOS-XR.

In older IOS versions (12.x), the command was introduced in 12.2(55)SE; earlier versions may not support it. In IOS 15.x and 16.x, the behavior is consistent. Note that on some switches, the `ip arp inspection validate` command may require the `ip dhcp snooping` feature to be enabled globally.

Always verify platform support with `show version` and `show feature`.

Related Commands

ip arp inspection vlan [id]

Enables Dynamic ARP Inspection (DAI) on specified VLANs to validate ARP packets and prevent ARP spoofing attacks.

ip dhcp snooping

Enables DHCP snooping globally on the switch to filter untrusted DHCP messages and prevent rogue DHCP server attacks.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions