topic Dynamic ARP Inspection (DAI) in Cloud Networking Platform

Dynamic ARP Inspection (DAI)

tantony — Mon, 30 Aug 2021 15:17:35 GMT

Sorry if this is the wrong place, I couldn't find a general network section. My switches are Netgear (I know, I know), and I have DHCP Snooping enabled, and I'm also thinking about enabling Dynamic ARP Inspection (DAI). Do you guys have DHCP Snooping and DAI enabled at your production network?

I know DAI looks at the DHCP Snooping database to compare the MAC and IP, but with people working from their home, what happens when they return to work since their laptops will not be in the DHCP Snooping database. I know you can manually add them but that's a lot of work.

Also, what about 802.1X authentication, anyone using them on their production network?

I'm trying to make my production network more secure.

Re: Dynamic ARP Inspection (DAI)

ww^ — Mon, 30 Aug 2021 16:43:07 GMT

If your clients connect to the switch and get a dhcp address the snooping table will fill. Only client with static assigned address need to have a static entry in the switch.

Re: Dynamic ARP Inspection (DAI)

tantony — Mon, 30 Aug 2021 17:19:30 GMT

Wouldn't the client's MAC already have to be in the DHCP Snooping table even to get DHCP? I'm talking about a new device that never connected before.

Re: Dynamic ARP Inspection (DAI)

ww^ — Mon, 30 Aug 2021 17:24:28 GMT

No.

Dhcp snooping prevent dhcp server side packets(offer,ack) from being send from untrusted ports. (You have to trust ports to the dhcp server like trunks and the port the dhcp server is on)

So it prevents from unwanted dhcp servers on your network

And it fills the dhcp snooping table based on the dhcp packets.

Re: Dynamic ARP Inspection (DAI)

tantony — Mon, 30 Aug 2021 17:33:28 GMT

Ah right, I forgot about that part. I already have the trunk and lags as trusted, and rest untrusted.

So far, I've only enabled DAI on one of the switch, and everything is working.

Re: Dynamic ARP Inspection (DAI)

tantony — Mon, 30 Aug 2021 17:34:14 GMT

Love to hear if anyone is using 802.1X on their network also.