Security
Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing and man-in-the-middle attacks on a VLAN.
What you need to know
- DAI relies on the DHCP snooping binding table, so DHCP snooping must be enabled and functioning first for dynamic hosts.
- Trusted DAI ports (typically uplinks and switch-to-switch links) do not have ARP packets inspected.
- Untrusted ports (default state) have both ARP request and reply source MAC/IP validated against the binding table.
- For hosts with static IP addresses, ARP ACLs (arp access-list) must be configured and applied since no DHCP snooping binding exists for them.
- DAI is enabled per VLAN with ip arp inspection vlan X.
- Rate limiting (ip arp inspection limit rate) on untrusted ports protects against ARP flooding.
- Invalid ARP packets on untrusted ports are logged and dropped, and can be viewed with show ip arp inspection statistics or log.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| ip dhcp snooping | config | Prerequisite: enable DHCP snooping globally before DAI can trust dynamic bindings. |
| ip dhcp snooping vlan 10 | config | Prerequisite: enable DHCP snooping for the VLAN being protected. |
| ip arp inspection vlan 10 | config | Enable Dynamic ARP Inspection on the VLAN. |
| arp access-list STATIC-HOSTS | config | Create an ARP ACL for hosts with static IP addressing. |
| permit ip host 10.0.0.5 mac host 0011.2233.4455 | config-acl | Permit a specific static host's IP-to-MAC binding inside the ARP ACL. |
| ip arp inspection filter STATIC-HOSTS vlan 10 | config | Apply the ARP ACL to the VLAN for static host validation. |
| interface gi0/1 | config | Enter the uplink or switch-to-switch interface. |
| ip arp inspection trust | config-if | Mark the interface as trusted so its ARP traffic is not inspected. |
| interface range fa0/1 - 24 | config | Enter a range of untrusted access ports. |
| ip arp inspection limit rate 15 | config-if | Limit ARP packets per second on untrusted ports. |
Verify it
- show ip arp inspection
- show ip arp inspection vlan 10
- show ip arp inspection interfaces
- show ip arp inspection statistics
- show ip dhcp snooping binding
Common mistakes
- Enabling DAI without DHCP snooping active, causing all dynamic ARP traffic to be dropped as invalid.
- Forgetting to trust the switch uplink port, causing legitimate ARP traffic between switches to be dropped.
- Not creating an ARP ACL for statically addressed hosts, since they have no DHCP snooping binding.
- Enabling DAI on the wrong VLAN or forgetting to enable it on all VLANs carrying protected hosts.
- Setting ARP rate limits too low for legitimate traffic volume, causing ports to be err-disabled unexpectedly.
Practise Dynamic ARP Inspection (DAI) in a real CLI
Generated labs, graded against the simulated network state.