Cisco IE 4000, Software Configuration Manual

Page: 413 / 1066

409
Configuring Dynamic ARP Inspection
How to Configure Dynamic ARP Inspection

DAI is not effective for hosts connected to switches that do not support DAI or that do not have this feature enabled.
Because man-in-the-middle attacks are limited to a single Layer 2 broadcast domain, separate the domain with DAI
checks from the one with no checking. This action secures the ARP caches of hosts in the domain enabled for DAI.

DAI depends on the entries in the DHCP snooping binding database to verify IP-to-MAC address bindings in
incoming ARP requests and ARP responses. Make sure to enable DHCP snooping to permit ARP packets that have
dynamically assigned IP addresses. For configuration information, see
Configuring Dynamic ARP Inspection,
page 405
When DHCP snooping is disabled or in non-DHCP environments, use ARP ACLs to permit or to deny packets.

DAI is supported on access ports, trunk ports, EtherChannel ports, and private VLAN ports.
Note: Do not enable DAI on RSPAN VLANs. If DAI is enabled on RSPAN VLANs, DAI packets might not reach the
RSPAN destination port.

A physical port can join an EtherChannel port channel only when the trust state of the physical port and the channel
port match. Otherwise, the physical port remains suspended in the port channel. A port channel inherits its trust state
from the first physical port that joins the channel. Consequently, the trust state of the first physical port need not
match the trust state of the channel.
Conversely, when you change the trust state on the port channel, the switch configures a new trust state on all the
physical ports that comprise the channel.

The operating rate for the port channel is cumulative across all the physical ports within the channel. For example,
if you configure the port channel with an ARP rate-limit of 400 pps, all the interfaces combined on the channel
receive an aggregate 400 pps. The rate of incoming ARP packets on EtherChannel ports is equal to the sum of the
incoming rate of packets from all the channel members. Configure the rate limit for EtherChannel ports only after
examining the rate of incoming ARP packets on the channel-port members.
The rate of incoming packets on a physical port is checked against the port-channel configuration rather than the
physical-ports configuration. The rate-limit configuration on a port channel is independent of the configuration on
its physical ports.
If the EtherChannel receives more ARP packets than the configured rate, the channel (including all physical ports) is
placed in the error-disabled state.

Make sure to limit the rate of ARP packets on incoming trunk ports. Configure trunk ports with higher rates to reflect
their aggregation and to handle packets across multiple DAI-enabled VLANs. You also can use the
ip arp inspection
limit none interface configuration command to make the rate unlimited. A high rate-limit on one VLAN can cause a
denial-of-service attack to other VLANs when the software places the port in the error-disabled state.

When you enable DAI on the switch, policers that were configured to police ARP traffic are no longer effective. The
result is that all ARP traffic is sent to the CPU.
How to Configure Dynamic ARP Inspection
Configuring Dynamic ARP Inspection in DHCP Environments
This procedure shows how to configure DAI when two switches support this feature. Host 1 is connected to Switch A,
and Host 2 is connected to Switch B as shown in
Figure 64 on page 407 . Both switches are running DAI on VLAN 1 where
the hosts are located. A DHCP server is connected to Switch A. Both hosts acquire their IP addresses from the same
DHCP server. Therefore, Switch A has the bindings for Host 1 and Host 2, and Switch B has the binding for Host 2.
Before You Begin
You must perform this procedure on both switches. This procedure is required.