liveBook · Manning

Arp access control list

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

An ARP access control list is a manually configured set of IP-to-MAC address mappings that Dynamic ARP Inspection can use to validate ARP messages.

An ARP access control list (ARP ACL) manually maps an IP address to a MAC address so Dynamic ARP Inspection (DAI) can validate ARP messages from devices that do not use DHCP. Without such a mapping, DAI may discard messages received on untrusted ports because no DHCP Snooping binding exists. section 14.2.1 section 14.3

Configure and apply an ARP ACL per VLAN:

  • For infrastructure devices, trusting the connected port remains the general recommendation. section 14.2.1

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes
Defines IP-MAC entries and VLAN application, but does not detail broader ARP ACL behavior beyond DAI filtering.
Examples
Uses SW2’s VLAN 1 SVI, IP address 10.0.0.3, and MAC address 5254.000c.8001.
What it assumes
Assumes Dynamic ARP Inspection is enabled and recognizes that manually addressed devices lack DHCP Snooping bindings.
What you can do after
Apply it via Cisco IOS CLI to allow matching ARP messages on untrusted ports.
How it connects
Links Dynamic ARP Inspection with DHCP Snooping binding tables, ARP messages, VLANs, and trusted ports.
Cover of Acing the CCNA Exam: Volume 2 Advanced Networking and Security
liveBookmanning.com
Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.