Dynamic ARP Inspection

3560Switch(config)#ip arp inspection vlan 10

Enables DAI on VLAN 10

3560Switch(config)#ip arp inspection vlan 10,20

Enables DAI on VLANs 10 and 20

3560Switch(config)#ip arp inspection vlan 10-20

Enables DAI on VLANs 10 to 20 inclusive

3560Switch(config)#ip arp inspection validate src-mac

Configures DAI to drop ARP packets when the source MAC address in the body of the ARP packet does not match the source MAC address specified in the Ethernet header. This check is performed on both APR requests and responses.

3560Switch(config)#ip arp inspection validate dst-mac

Configures DAI to drop ARP packets when the destination MAC address in the body of the ARP packet does not match the destination MAC address specified in the Ethernet header. This check is performed on both APR requests and responses.

Switch(config)#interface fastethernet 0/24

Moves to interface config mode

Switch(config-if)#ip arp inspection trust

Configures the connection between switches as trusted

NOTE: By default, all interfaces are untrusted.

Verifying DAI

Switch#show ip arp inspection interfaces

Verifies the dynamic ARP configuration

Switch#show ip arp inspection vlan 10

Verifies the dynamic ARP configuration for VLAN 10

Switch#show ip arp inspection statistics vlan 10

Displays the dynamic ARP inspection statistics for VLAN 10

802.1x Port-Based Authentication

The IEEE 802.1x standard defines an access control and authentication protocol that prevents unauthorized hosts from connecting to a LAN through publicly accessible ports unless they are properly authenticated. The authentication server authenticates each host connected to a switch port before making available any services offered by the switch or the LAN.

Switch(config)#aaa new-model

Enables authentication, authorization, and accounting (AAA)

Switch(config)#aaa authentication dotlx default group radius

Creates an 802.1x port-based authentication method list. This method specifies using a RADIUS server for authentication.

NOTE: A method list describes the sequence and authentication methods to be queried to authenticate a user. The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cycle, the authentication process stops, and no other authentication methods are attempted.

NOTE: To create a default list that is used when a named list is not specified, use the default keyword followed by methods that are to be used in default situations.

NOTE: When using the aaa authentication dotlx command, you must use at least one of the following keywords:

group radius—Use a list of RADIUS servers for authentication.

none—Use no authentication. The client is automatically authenticated without the switch using information supplied by the client. This method should only be used as a second method. If the first method of group radius is not successful, the switch will use the second method for authentication until a method is successful. In this case, no authentication would be used.

Switch(config)#dot1x system-auth-control

Globally enables 802.1x port-based authentication

Switch(config)#interface fastethernet 0/1

Moves to interface config mode

Switch(config-if)#dot1x port-control auto

Enables 802.1x authentication on this interface

NOTE: The auto keyword allows the port to begin in the unauthorized state. This will allow only Extensible Authentication Protocol over LAN (EAPOL) frames to be sent and received through the port. Other keywords available here are these:

force-authorized—Disables 802.1x authentication and causes the port to transition to the authorized state without any authentication exchange required. This is the default setting.

force-unauthorized—Causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate. The switch cannot provide authentication services to the client through the interface.

Switch#show dot1x

Verifies your 802.1x entries