72. Dynamic ARP Inspection
Dynamic ARP Inspection (DAI)
checks ARP packets to see if it's being used for a security attack (ARP poisoning)
2 Ways in DAI implementation
a. using the DHCP Snooping Binding Table
b. Using ARP ACL
Configuring DAI (Dynamic ARP Inspection)
*to configure DAI, use the ff. syntax:
en
conf t
ip arp inspection vlan (vlan#) or
ip arp inspection vlan (vlan lower limit) - (vlan upper limit) or
ip arp inspection vlan (vlan), (vlan)
*to configure a DAI Trusted port:
en
conf t
interface (interface name)
ip arp inspection trust
*to verify.
#show ip arp inspection