Mitigating ARP Injection in a Multi-layered Network

One of my clients has an interesting issue:
<------quote---->
How to deploy ARP injection safeguards in a campus in the environment below:

   * 2 4500 switches supporting over 25 3750 Series Switches
connecting over 500 users.
   * Each Switch has two uplinks to the 4500 on fibre and running RSTP
   * Campus LAN is segmented using VLANs for Voice and Data.

ARP inspection and DHCP Snooping are supposed to work together.

One of the challenges for instance is, how do you bind a HSRP standby
IP by its MAC address where it has no interface of it's own or do you
use its SVI address?

I feel the trust relations are not forming well enough, thus the
uplinks keep getting shut.

Does the Native VLAN play a role in these configurations?
-------</quote>------

As I work with them to recreate this in a lab, it would be nice to
know if anyone has some experience on the above.

Gitau

Blogs and organic groups at http://www.ccie.net
Received on Mon Aug 01 2011 - 19:44:43 ART