Layer 3 Forward and ARP Configuration
Chapter 6 Dynamic ARP Inspection Configuration
http://www.level1.com
6-1
Chapter 6 Dynamic ARP Inspection
Configuration
6.1 Introduction to Dynamic ARP Inspection
Configuration
DAI (Dynamic ARP Inspection) is a kind of security property that it can verificate the
ARP data packets in the network. Through DAI, the administrator can intercept, record
and drop the ARP data packets which have the invalid MAC address/IP address.
The dynamic ARP inspection judges the legality of the ARP data packets according to
the lawful IP and MAC addresses in a trusted database. This database can be created by
the manual static appointing or the dynamic DHCP monitoring learning. If the ARP data
packet is received from the trusted port, the switch will not inspect it and forward it directly.
If the ARP data packet is received from the untrusted port, the switch will only forward the
lawful data packet. For the illegal data, it will drop the data directly and record this action.
Notice: The trusted/untrusted port above is not the one of DHCP monitoring, it is the
rules that the dynamic ARP inspection function needs to configure.
6.2 Dynamic ARP Inspection Configuration Task List
1. Enable the dynamic ARP inspection based on vlan
Command
Explanation
Global Mode
ip arp inspection vlan <vlan-id>
no ip arp inspection vlan <vlan-id>
Enable the dynamic ARP inspection
function based on vlan. The no command
disables it.
2. Configure the trusted port
Command
Explanation
Port Mode
ip arp inspection trust
no ip arp inspection trust
Configure the port as the trusted port of the
dynamic ARP inspection. The no command
