1、Dynamic ARP Inspection解析
结合DHCP Snooping，当配置了Dynamic ARP Inspection的交换机untrusted接口收到ARP信息后，交换机首先检查dhcp snooping binding，如果发现与绑定条目不一致，就丢弃收到的数据包。
2、实验拓扑
3、基础配置
IOU3配置
no ip routing
ip dhcp pool pool3
network 3.3.3.0 255.255.255.0
interface Ethernet0/0
ip address 3.3.3.3 255.255.255.0
IOU4配置
no ip routing
ip dhcp pool pool4
network 4.4.4.0 255.255.255.0
interface Ethernet0/0
ip address 4.4.4.4 255.255.255.0
IOU5配置
interface Ethernet0/0
ip address dhcp
4、DHCP Snooping配置
IOU1配置
ip dhcp snooping vlan 1
ip dhcp snooping
interface Ethernet0/1
ip dhcp snooping trust
interface Ethernet0/2
ip dhcp snooping trust
IOU2配置
ip dhcp snooping vlan 1
ip dhcp snooping
interface Ethernet0/2
ip dhcp snooping trust
IOU3配置
ip dhcp relay information trust-all
IOU4配置
ip dhcp relay information trust-all
5、Dynamic ARP Inspection配置
IOU1配置
ip arp inspection vlan 1
interface Ethernet0/1
ip arp inspection trust
interface Ethernet0/2
ip arp inspection trust
IOU2配置
ip arp inspection vlan 1
interface Ethernet0/2
ip arp inspection trust
本文出自 “开源殿堂” 博客，请务必保留此出处http://kaiyuandiantang.blog.51cto.com/10699754/1734179
89、交换机安全欺骗攻击配置实验之Dynamic ARP Inspection
原文：http://kaiyuandiantang.blog.51cto.com/10699754/1734179