Dynamic ARP insepection question

[MrOyvind]

Hi

Log from one of the switches in our Intranet.

un 20 13:08:29.667 CEST: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Fa0/14, vlan 266.([0013.21f4.27de/10.101.7.34/0000.0000.0000/10.101.7.1/13:08:28 CEST Wed Jun 20 2012])

IP adress on host connected to Fa0/14 : 10.101.7.34
Default gateway : 10.101.7.1

The reason is maybe something wrong with the ARP table or the DHCP snooping bindings, maybe a man in the middle attack.
Need to know the location of the host that was the reason is located. From another host in the the network, or the host on Fa 0/14 ?
Req means request so maybe something was wrong with the MAC to IP bindings for the host on Fa0/14 ?



Thank you,

Best regards,

Oyvind

 

[mhdbadi]

can you issue a traceroute command for the wanted host and the switch management IP? post the output please.

 

[MrOyvind]

Hi

ARP inspection is feature for the local network.
What to do with traceroute and the managment IP address isolated in another VLAN ?

 

[mhdbadi]

You receive this message when the MAC address does not match the binding. In order to display the DHCP snooping binding entries, use the show ip dhcp snooping binding command. If the device does not use DHCP or the information is correct and you trust the device on the port, you can enable trust on that port with the ip arp inspection trust command.

Also, DHCP snooping must be enabled in order to permit ARP packets that have dynamically assigned IP addresses with the ip dhcp snooping command.