Dynamic ARP Inspection (DAI)

[bluesea2010]

Hi ,

I have a Layer 3 access switch and need to enable Dynamic ARP Inspection (DAI). Since DAI relies on the DHCP snooping binding database, and DHCP snooping is typically not required on Layer 3 switches, how can DAI be properly configured in this scenario?

Thanks

[Karsten Iwen]

It is not relevant if the switch is layer 2 or layer 3. Both DAI and DHCP Snooping are functions to secure the access-layer. You can, but don't have to use L3 on the access switch when you configure DAI. 

The fact that DHCP snooping is typically not done on L3 switches comes from the fact that in many scenarios the access layer is L2 and the distribution/core is L3. There, you don't need DHCP snooping. But not because it's an L3 device but because there are no end devices on these switches.

[M02@rt37]

Hello @bluesea2010 

It’s not about whether the switch is L2 or L3 capable, but rather about its role in the network topology and whether end device are connected to it.

[bluesea2010]

Hi 

Here is my configuration ,  

ip dhcp snooping
ip dhcp snooping vlan 10

interface Te1/1 ( routed interface )
description to-the-coreswitch
no switchport
ip address 192.168.255.1 255.255.255.252

interface gi0/1 (client pc)
switchport
switchport mode access
switchport access vlan 10
ip dhcp snooping limit rate 100

the above is dhcp snooping part  , Now I want to enbale DAI  on the same switch 

Please help 

[Royalty]

Hi @bluesea2010,

A lot of good other comments by others in this thread.

I think we can agree DHCP snooping is not required for DAI. However, as your switch is an L3 access switch, it most likely has clients connected to the switch who will obtain their IP address through DHCP. If this is the case, the only practical implementation of DAI is to use it with DHCP snooping. You can't manage ARP ACLs in an environment where your switch is connected to clients that have dynamic IP addressing, because DHCP leases can change. This could mean clients renew their DHCP lease, get a different IP, and that ACL is then no longer a match and ARP requests/replies are invalidated. There are ways in which you can use ARP ACLs to reference a range of IPs that can be tied to trusted MACs, but that still allows the possibility for other network attacks. There's also not really much point if you can use DHCP snooping. Even with DHCP snooping you will need ARP ACLs if you have any devices (e.g. servers) with static IP addresses though as there will not be an entry in the snooping database for them. Before enabling DAI you should check that the DHCP snooping binding database is populated accordingly with 'show ip dhcp snooping binding'

Your basic configuration could look something like this:

CONFIG:

ip dhcp snooping
ip dhcp snooping vlan 10
!
ip arp inspection vlan 10

OPTIONAL CONFIG (FOR YOUR DEVICES WITH STATIC IP):

arp access-list DAI_STATIC_IP_LIST
 permit ip host x.x.x.x mac host aaaa.aaaa.aaaa
 permit ip host y.y.y.y mac host bbbb.bbbb.bbbb
 (etc.)
!
ip arp inspection filter DAI_STATIC_IP_LIST vlan 10 {static}

If you do have a DHCP server and it happens to be in VLAN 10 on another switch port connected to the same L3 access switch then you will need to configure that interface as 'ip dhcp snooping trust' and 'ip arp inspection trust'. (or use ARP ACL, but former is preferred). If the DHCP server is remote, or in a different VLAN for which DAI is not configured, then no further action is needed. If your L3 access switch is connected via an L2 trunk to another switch you will also need to take this into consideration with the ARP inspection config as well. Of course in your case there shouldn't be an L2 switch connected, at least under a proper hierarchical design, but it's just a note. Specifically, that interface needs an 'ip arp inspection trust' command under the interface as well. If there is no DHCP running at all for any clients connected to the switch, just use an ARP ACL for every device and turn off DHCP snooping.

The two interfaces you have posted (Te1/1 and Gi0/1) do not need any changes, but I recommend you to consult the documentation for feature enhancements like ARP rate limiting (a default is already configured) and additional DAI validation features that can perform additional checks on top and in addition to the basic validation.

[shambhu.kumar]

Hello,

DAI inspects all ARP packets on untrusted interfaces, it checks incoming APR packets against a trusted database, which is populated by DHCP snooping
Let us assume Host A is in VLAN 10, and access switches are connected back to back with G0/1 interface (which is trusted interface)

so, host A in VLAN 10 will be untrusted. ARP packet coming from this interface will be checked.

config t
ip arp inspection vlan 10

interface G0/1
ip arp inspection trust

similar configuration apply on other switch.

for verification,
show ip arp inspection vlan 10
sh ip arp inspection interface G0/1

[MHM Cisco World]

Use ARP ACL for non dhcp SW.

This allow you to run DAI.

MHM

[paul driver]

Hello
As already stated, DHCP snooping isnt required, using static arp inspection its actually read before any snooping DB is called upon.

Example:

no ip dhcp snooping
no ip dhcp snooping vlan 100

arp access-list inspect
permit ip host x.x.x.x mac host 0000.0000.1111
permit ip host x.x.x.y mac host 0000.0000.1112
etc..

ip arp inspection filter-list vlan 100 static inspect

[bluesea2010]

It's an access stack switch with four members, and all clients obtain their IP addresses from a DHCP server. How can I ensure the ARP access list stays up to date.

Below is my topology 

[MHM Cisco World]

DAI useless in core 

You need to Config it in SW direct connect to host. 

MHM

[bluesea2010]

Yes it is not on core, on access switch 

[MHM Cisco World]

SW run dhcp why then yoh not run dhcp snooping?

Arp acl work for endpoint have always same IP. 

MHM

[bluesea2010]

On an L3 interface, we can't configure it as trusted, so the following commands should be sufficient on the L3 access switch. I’m currently using this configuration, although some people are suggesting it may not be necessary

ip dhcp snooping
ip dhcp snooping vlan 10 

[Jens Albrecht]

DHCP snooping only makes sense if you connect clients to this switch that get the IP addresses via DHCP.
So if you do not connect clients to your core switch then simply delete the DHCP snooping config on that switch.

DHCP snooping is a L2 feature that only works on L2 switchports - either access or trunk.
Therefore, you cannot configure a L3 interface as trusted because snooping is not running on L3 interfaces.

HTH!

[bluesea2010]

Hi ,

The topic here is DAI , not  the dhcp snooping