ARP isn't showing all the interfaces/MAC bindings

Question

I'm playing with Dot1x port authentication, the interface G2/0/2 is connected to a PC and is authenticated/authorized successfully:

SW1-2960#show authentication sessions int g2/0/2 det
            Interface:  GigabitEthernet2/0/2
          MAC Address:  <hidden>
         IPv6 Address:  Unknown
         IPv4 Address:  10.13.2.12
            User-Name:  nicole
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-auth
     Oper control dir:  both
      Session timeout:  900s (local), Remaining: 215s
       Timeout action:  Reauthenticate
      Restart timeout:  N/A
Periodic Acct timeout:  N/A
       Session Uptime:  688s
    Common Session ID:  0A304A190000004026FD9FC8
      Acct Session ID:  0x00000020
               Handle:  0x8A000026
       Current Policy:  POLICY_Gi2/0/2

Local Policies:
        Service Template: DEFAULT_LINKSEC_POLICY_SHOULD_SECURE (priority 150)

Server Policies:
              ACS ACL:  xACSACLx-IP-TEMP_ACL-60b7be60 <From ISE>

Method status list:
      Method            State

      dot1x              Authc Success

IP device tracking shows that the IP/MAC binding is successful using ARP:

SW1-2960#show ip device tracking all
Global IP Device Tracking for clients = Enabled
Global IP Device Tracking Probe Count = 3
Global IP Device Tracking Probe Interval = 30
Global IP Device Tracking Probe Delay Interval = 0
-----------------------------------------------------------------------------------------------
  IP Address    MAC Address   Vlan  Interface           Probe-Timeout      State    Source
-----------------------------------------------------------------------------------------------
10.13.2.12     <Hidden>        1    GigabitEthernet2/0/2   30              ACTIVE   ARP

However, this isn't reflected on the ARP table:

SW1-2960#show arp | i g2/0/2
SW1-2960#

What could be the reason?

My configuration under the interface is basic:

SW1-2960#show running-config int g2/0/2
Building configuration...

Current configuration : 404 bytes
!
interface GigabitEthernet2/0/2
 switchport mode access
 ip access-group BLOCK in
 authentication host-mode multi-auth
 authentication open
 authentication order dot1x mab
 authentication priority dot1x mab
 authentication port-control auto
 authentication periodic
 authentication timer reauthenticate 900
 authentication timer restart 2
 mab
 dot1x pae authenticator
 spanning-tree portfast edge
end

SW1-2960#

The BLOCK ACL is overridden by the ACL xACSACLx-IP-TEMP_ACL-60b7be60 which is provided by ISE.

ARP table shows only bindings for the interface G2/0/45:

SW1-2960#show ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  <hidden ip>              0  <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>             29  <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>            67   <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>             -   <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>             0   <hidden MAC>    ARPA   GigabitEthernet2/0/45
Internet  <hidden ip>            66   <hidden MAC>    ARPA   GigabitEthernet2/0/45
...........

SW1-2960#show running-config int g2/0/45
Building configuration...

Current configuration : 92 bytes
!
interface GigabitEthernet2/0/45
 no switchport
 ip address <Some IP address> 255.255.254.0
end

SW1-2960#

Is there a way to show all ARP bindings?

Answer 1

Do not confuse layer-2 interfaces with layer-3 interfaces. Only layer-3 interfaces have ARP tables. The layer-2 interfaces feed the CAM tables, but not the ARP tables.

Your switch interface in question is a layer-2 interface based on the configuration you show:

interface GigabitEthernet2/0/2
 switchport mode access

That interface will not have an ARP table. If you have a layer-3 SVI for the VLAN of that interface, you may have the ARP information of devices connected to that layer-2 interface in the ARP table of the layer-3 SVI. That depends on any layer-3 communications, or lack of, between any devices on the layer-2 interface and the SVI layer-3 interface.

Basically, you are looking for an ARP table on an interface that does not have an ARP table.