Specifications

Dynamic ARP Inspection Overview
18-18 DHCP Snooping and Dynamic ARP Inspection
Eligible Interfaces
DynamicARPinspectionisenabledperVLAN,effectivelyenablingDAIonthemembersofthe
VLAN,eitherphysicalportsorLAGs.TrustisspecifiedontheVLANmembers.
DAIcannotbeenabledonport‐basedroutinginterfaces.Itmaybeconnectedto:
•Asinglehostthroughatrustedlink(forexample,
aserver)
•Ifmultiplehostsneedtoconnected,theremustbeaswitchbetweentherouterandthehosts, 
withDAIenabledonthatswitch
Interaction with Other Functions
•DAIreliesontheDHCPsnoopingapplicationtoverifythata{IPaddress,MACaddress,
VLAN,interface}tupleisvalid.
•DAIregisterswithdot1qtoreceivenotificationofVLANmembershipchangesfortheVLANs
whereDAIisenabled.
•DAItellsthedriverabouteachuntrustedinterface(physicalportorLAG)where
DAIis
enabledsothatthehardwarewillint erceptARPpacketsand sendthemtotheCPU.
Basic Configuration
Thefollowingbasicconfigurationdoesnotchange thedefaultratelimitingparameters.
Procedure 18-2 Basic Dynamic ARP Inspection Configuration
Step Task Command(s)
1. Configure DHCP snooping. Refer to Procedure 18-1 on page 18-3.
2. Enable ARP inspection on the VLANs where
clients are connected, and optionally, enable
logging of invalid ARP packets.
set arpinspection vlan vlan-range
[logging]
3. Determine which ports are not security threats
and configure them as DAI trusted ports.
set arpinspection trust port
port-string enable
4. If desired, configure optional validation
parameters.
set arpinspection validate
{[src-mac] [dst-mac] [ip]}
5. If desired, configure static mappings for DAI by
creating ARP ACLs:
• Create the ARP ACL
• Apply the ACL to a VLAN
set arpinspection filter name permit
ip host sender-ipaddr mac host
sender-macaddr
set arpinspection filter name vlan
vlan-range [static]