EKI-9500 Series User Manual
170
4.4.5
Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) is a security feature that rejects invalid and malicious
ARP packets. DAI prevents a class of man-in-the-middle attacks, where an unfriendly
station intercepts traffic for other stations by poisoning the ARP caches of its unsus-
pecting neighbors. The miscreant sends ARP requests or responses mapping
another station's IP address to its own MAC address.
DAI relies on DHCP snooping. DHCP snooping listens to DHCP message exchanges
and builds a binding database of valid {MAC address, IP address, VLAN, and inter-
face} tuples.
When DAI is enabled, the switch drops ARP packets whose sender MAC address
and sender IP address do not match an entry in the DHCP snooping bindings data-
base. You can optionally configure additional ARP packet validation.
4.4.5.1
Global
Use the Global Configuration page to configure global DAI settings.
To access this page, click
Switching
>
Dynamic ARP Inspection
>
Global
.
Figure 4.181 Switching > Dynamic ARP Inspection > Global
The following table describes the items in the previous figure.
4.4.5.2
VLAN
Use the Dynamic ARP Inspection VLAN Configuration page to view and configure
Dynamic ARP Inspection (DAI) settings for VLANs. When DAI is enabled on a VLAN,
DAI is enabled on all interfaces that are members of that VLAN.
Item
Description
Validate Source
MAC
When this option is selected, DAI verifies that the sender hardware
address in the ARP packet equals the source MAC address in the
Ethernet header. If the addresses do not match, the ARP packet is
dropped.
Validate Destination
MAC
When this option is selected, DAI verifies that the target hardware
address in the ARP packet equals the destination MAC address in the
Ethernet header. If the addresses do not match, the ARP packet is
dropped. This check applies only to ARP responses because the tar-
get MAC address is unspecified in ARP requests.
Validate IP
When this option is selected, DAI drops ARP packets with an invalid IP
address. The following IP addresses are considered invalid:
0.0.0.0
255.255.255.255
All IP multicast addresses
All class E addresses (240.0.0.0/4)
Loopback addresses (in the range 127.0.0.0/8)
Submit
Click
Submit
to save the values and update the screen.
Refresh
Click
Refresh
to update the screen.
Cancel
Click
Cancel
to restore default value.
