Configuring DHCP Secured ARP

Before you configure DHCP secured ARP, you must enable DHCP snooping on the switch.

Another method available to populate the ARP table is DHCP secured ARP. DHCP secured ARP requires that ARP entries be added to or deleted from the ARP table only when the DHCP server assigns or re-assigns an IP address. These entries are known as a secure ARP entry. If configured, the switch adds the MAC address and its corresponding IP address to the ARP table as a permanent ARP entry. Regardless of other ARP requests and replies seen by the switch, the switch does not update secure ARP entries. DHCP secured ARP is linked to the “DHCP snooping” feature. The same DHCP bindings database created when you enabled DHCP snooping is also used by DHCP secured ARP to create secure ARP entries. The switch only removes secure ARP entries when the corresponding DHCP entry is removed from the trusted DHCP bindings database.

Note

If you enable DHCP secured ARP on the switch without disabling ARP learning, ARP learning continues which allows insecure entries to be added to the ARP table.

Enable DHCP snooping using the command:
enable ip-security dhcp-snooping [dynamic | {vlan} vlan_name] ports [all | ports] violation-action [drop-packet {[block-mac | block-port] [duration duration_in_seconds | permanently] | none]}] {snmp-trap}

For more information about DHCP snooping see, Configuring DHCP Snooping.

DHCP secured ARP learning is disabled by default.
Enable DHCP secured ARP using the command:
enable ip-security arp learning learn-from-dhcp [dynamic vlan | {vlan} vlan_name] ports [all | ports]

DHCP Secured ARP must be enabled on the DHCP server port as well as the DHCP client ports.
Disable DHCP secured ARP using the command:
disable ip-security arp learning learn-from-dhcp [dynamic vlan | {vlan} vlan_name ports [all | ports]
Note
You must enable DHCP secured ARP on the DHCP server, as well as on the client ports. DHCP snooping must also be enabled on both the server and client ports.