Dynamic ARP Inspection: Untrusted Uplink
Hardening a VLAN with ARP inspection blackholed the gateway. Diagnose the trust boundary and fix it yourself, live, right below.
Symptom
Turning on ARP inspection broke the very traffic it was meant to protect. Find the interface that should have been trusted and read the drop counters that prove it.
Your mission
Prove the cause, then fix it
Format
Guided CLI investigation
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: SW-ACC
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
Dynamic ARP inspection was enabled on VLAN 10 during a hardening change. Access ports still work, but nothing in VLAN 10 can reach the default gateway any more, and the ARP inspection drop counter climbs steadily.
What you'll practice
- Explain how dynamic ARP inspection validates ARP against the DHCP snooping bindings
- Read per-VLAN ARP inspection statistics
- Read per-interface ARP inspection trust state
- Recognise why an uplink must be trusted while access ports must not
- Verify the fix with the same counters that proved the fault
The topology
One access switch with DHCP snooping and ARP inspection enabled on the user VLAN, a user access port, and an uplink to the distribution switch that carries the gateway.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
show ip arp inspectionshow ip arp inspection interfacesshow ip dhcp snoopingTopology diagram
Frequently asked
Why must the uplink be trusted rather than adding static ARP entries?
The gateway and everything beyond it were never leased an address by the snooped DHCP server, so they can never appear in this switch's binding table. Trust on the uplink is how you tell the switch that ARP arriving from the rest of the network has already been vouched for elsewhere.
Should access ports be trusted too?
No. Trusting the access ports would disable the check entirely and defeat the point of the feature. Untrusted access ports plus a trusted uplink is the standard pattern, exactly as with DHCP snooping.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.