Dynamic ARP inspection

[tedauction]

Hello, regarding the feature DAI dynamic ARP inspection (part of DHCP snooping).

Will this feature drop traffic that does not a DHCP snooping binding database table entry ?

For instance if you have a statically configured computer that has not generated a DCHP table entry, will DAI drop or allow traffic from this machine ?

In other words, does DAI only care about ARP 'conflicts' with the DHCP table ?

[Karsten Iwen · Accepted solution]

For a system on an untrusted port, you need a binding. This can come from the DHCP-snooping database (preferred) or from a static entry. If possible configure your "static" system with DHCP and a reservation on the DHCP-server.

For the static approach, you configure an arp-acl and apply that to DAI:

arp access-list DAI-VL10
permit ip host 10.10.10.1 mac host aaaa:bbbb:cccc
!
ip arp filter inspection filter DAI-VL10 vlan 10