Ccie - Dhcp Snooping And Dynamic Arp Inspection

Front 1

Global command to enable dhcp snooping for one or more VLANs

Back 1

ip dhcp snooping vlan (vlan-range)

Front 2

Interface command to create a trusted interface (dhcp snooping)

Back 2

ip dhcp snooping trust

Front 3

Where should the command "ip dhcp snooping trust" be configured?

Back 3

A port which a DHCP server exists behind (also needs to be configured on trunk ports and WAN ports if necessary)

Front 4

Global command to add static entries to the DHCP snooping binding database

Back 4

ip dhcp snooping binding (mac-address) vlan (vlan-id) (ip-address) interface (interface-id) expiry (seconds)

Front 5

Interface subcommand to add the optional check of the ethernet source MAC address to be equal to a DHCP request's client id

Back 5

ip dhcp snooping verify mac-address

Front 6

Sets the maximum number of dhcp messages per second to mitigate DoS attacks

Back 6

ip dhcp snooping limit rate (rate)

Front 7

Global command to enable DAI

Back 7

Ip arp inspection vlan (vlan-range)

Front 8

Interface subcommand that disables DAI on the interface. (Interface defaults to enabled after the "ip arp inspection" global command has been configured.)

Back 8

Ip arp inspection trust

Front 9

Global command to refer to an ARP acl that defines static IP/MAC addresses to be checked by DAI for that VLAN

Back 9

ip arp inspection filter (ACL-NAME) vlan (VLAN-RANGE) [static]

Front 10

Enables additional optional checking of ARP messages

Back 10

ip ARP inspection validate {[src-mac] [dst-mac] [ip]}

Front 11

Limits the arp message rate to prevent DoS attacks

Back 11

Ip arp inspection limit {rate (PPS) [burst interval (seconds)] | none}

Front 12

What effect does the "update arp" command have when configured under the dhcp pool?

Back 12

The update arp command 'locks' the ARP entries in the ARP cache as the router assigns IP addresses via DHCP. The secured ARP entries cannot be removed from the cache by the clear arp-cache command. To remove the secure ARP entries, the DHCP bindings must also be deleted (clear ip dhcp binding).

Front 13

What effect does the subinterface command "authorize arp" have"?

Back 13

DHCP Authorized ARP disables dynamic ARP learning on an interface; therefore, you need to configure the ARP static entry

Front 14

Port security only works on:

Back 14

-Static trunks and access ports. Dynamic ports are not supported.

Front 15

If the port is an access-port configured with access and voice VLANs, youcan use commands to impose restrictions on just two VLANs, without evermentioning their numbers:

Back 15

switchport port-security maximum # vlan{access|voice}

Front 16

Subinterface command to define MAC address timeouts:

Back 16

switchport port-security aging timeout

switchport port-security aging type {absolute|inactivity}