Hi,
I have ip dhcp snooping and ip arp inspection enabled:
ip arp inspection vlan 311-314
ip arp inspection validate src-mac dst-mac ip
ip dhcp snooping vlan 311-314
ip dhcp snooping
This appears to enforce that, if you are on one of those vlans and
you don't have a dhcp assigned IP, you can't talk.
I am noticing however that if I do a ping scan of the subnets on
those vlans, even tho the switch should know what IP's are assigned via
is dhcp snooping database, it allows the arp's thru anyway for ip
addresses not in it's database. This seems a bit silly, why not save the
bandwidth and just drop outgoing arp on ports where the dhcp snooping db
doesn't have an entry for it?
Is there a cisco feature that would do this or am I being silly here?
Mike-
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
