cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
529
Views
4
Helpful
2
Replies
Highlighted

Dynamic ARP Inspection for non-DHCP Environment

Hi everyone,

I wish to deploy DAI (Dynamic ARP Inspection) for a non-DHCP Environment where all connected hosts are assigned with a static IP address.

ARP ACL as recommended in Cisco Docs can be used to achieve this so that ARP spoofing / poisoning can be mitigated.

This does not seem to be a scalable solution for my deployment scenario.

Multiple (more than 15) /25 Subnets,  presently having a different numbers of hosts in each subnet.

Prediction or probability of addition of new hosts in these subnets is also not possible. Hosts are added as per requirement.

Creation of ARP ACL manually seems to be working. But it requires manual configuration overhead and results in a lengthy multiple ACL entries.

Will "ip device-tracking" feature be helpful in some way for utilization with DAI for non-DHCP environment?       

Rajmohan R       

Rajmohan R
Everyone's tags (3)
2 REPLIES 2
Highlighted
VIP Mentor

Re:Dynamic ARP Inspection for non-DHCP Environment

Hello

static DAI is always checked first with or withput the dhcp snooping table but to have a dymanic setup I am on the understanding that dhcp snooping is required

res
paul

Sent from Cisco Technical Support Android App



kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
Highlighted

Dynamic ARP Inspection for non-DHCP Environment

Thanks Paul.

Does it means that IP Device tracing will be of no use in DAI implementation in non-dhcp environment.

Rajmohan R

Rajmohan R
CreatePlease to create content
Content for Community-Ad