Dynamic ARP inspection query

[vinod.rathi]

I am trying to inspect vlan 100 using Dynamic ARP inspection feature. My fwsm blade provides dhcp services to Vlan 100 users. Below is my configuration.

ip dhcp snooping vlan 100

ip dhcp snooping

ip arp inspection vlan 100

vlan 100,200,300

!

!

interface GigabitEthernet0/1

description ***DATA VLAN***

switchport access vlan 100

switchport mode access

switchport voice vlan 200

speed 1000

duplex full

spanning-tree portfast

!

interface GigabitEthernet0/2

description ***DATA VLAN***

switchport access vlan 100

switchport mode access

switchport voice vlan 200

speed 1000

duplex full

spanning-tree portfast

interface GigabitEthernet0/49

description ***UPLINK PORT TO FWSM-1***

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 100-124,400

switchport mode trunk

ip arp inspection trust

speed nonegotiate

ip dhcp snooping trust

interface GigabitEthernet0/50

description ***UPLINK PORT TO FWSM-2***

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 200,430

switchport mode trunk

ip arp inspection trust

speed nonegotiate

ip dhcp snooping trust

I keep getting the following message and denies all access to the network

%SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi0/5, vlan 100.([0016.d3b5.30a4/10.0.0.4/0000.0000.0000/10.0.0.1/07

Please suggest if I am missing anything.

Regards,

Vinod Rathi

[tstanik]

This message means that the switch has received Address Resolution Protocol (ARP) packets considered invalid by ARP inspection. The packets are erroneous, and their presence can show attempted man-in-the-middle attacks in the network. This log message appears when the IP and MAC address of the sender binding for the received VLAN is not present in the DHCP snooping database.

You receive this message when the MAC address does not match the binding. In order to display the DHCP snooping binding entries, use the show ip dhcp snooping binding command. If the device does not use DHCP or the information is correct and you trust the device on the port, you can enable trust on that port with the ip arp inspection trust command. Also, DHCP snooping must be enabled in order to permit ARP packets that have dynamically assigned IP addresses with the ip dhcp snooping command.