Cisco IE 4000, Software Configuration Manual

Page: 411 / 1066

407
Configuring Dynamic ARP Inspection
Information About Dynamic ARP Inspection
Figure 64 ARP Packet Validation on a VLAN Enabled for DAI
Configuring interfaces to be trusted when they are actually untrusted leaves a security hole in the network. If Switch A is
not running DAI, Host 1 can easily poison the ARP cache of Switch B (and Host 2, if the link between the switches is
configured as trusted). This condition can occur even though Switch B is running DAI.
DAI ensures that hosts (on untrusted interfaces) connected to a switch running DAI do not poison the ARP caches of
other hosts in the network. However, DAI does not prevent hosts in other portions of the network from poisoning the
caches of the hosts that are connected to a switch running DAI.
If some switches in a VLAN run DAI and other switches do not, configure the interfaces connecting these switches as
untrusted. However, to validate the bindings of packets from non-DAI switches, configure the switch running DAI with
ARP ACLs. When you cannot determine the bindings, at Layer 3 isolate switches running DAI from switches not running
DAI switches.
Note: Depending on the setup of the DHCP server and the network, it might not be possible to validate a given ARP
packet on all switches in the VLAN.
Rate Limiting of ARP Packets
The switch CPU performs DAI validation checks; therefore, the number of incoming ARP packets is rate-limited to
prevent a denial-of-service attack. By default, the rate for untrusted interfaces is 15 packets per second (pps). Trusted
interfaces are not rate-limited. You can change this setting by using the
ip arp inspection limit interface configuration
command.
When the rate of incoming ARP packets exceeds the configured limit, the switch places the port in the error-disabled
state. The port remains in that state until you intervene. You can use the
errdisable recovery global configuration
command to enable error-disable recovery so that ports automatically emerge from this state after a specified timeout
period.
Note: Unless you configure a rate limit on an interface, changing the trust state of the interface also changes its rate limit
to the default value for that trust state. After you configure the rate limit, the interface retains the rate limit even when its
trust state is changed. If you enter the
no ip arp inspection limit interface configuration command, the interface reverts
to its default rate limit.
Relative Priority of ARP ACLs and DHCP Snooping Entries
DAI uses the DHCP snooping binding database for the list of valid IP-to-MAC address bindings.
DHCP server
Switch A Switch B
Host 1
Host 2
Port 1 Port 3
111751