Interface Trust States And Network Security - Cisco Nexus 9000 Series Configuration Manual

Configuring Dynamic ARP Inspection

Interface Trust States and Network Security

DAI associates a trust state with each interface on the device. Packets that arrive on trusted interfaces bypass
all DAI validation checks, and packets that arrive on untrusted interfaces go through the DAI validation
process.
In a typical network configuration, the guidelines for configuring the trust state of interfaces are as follows:
Untrusted
Trusted
With this configuration, all ARP packets that enter the network from a device bypass the security check. No
other validation is needed at any other place in the VLAN or in the network.
Caution Use the trust state configuration carefully. Configuring interfaces as untrusted when they should be trusted
can result in a loss of connectivity.
Figure 16: ARP Packet Validation on a VLAN Enabled for DAI
The following figure assumes that both device A and device B are running DAI on the VLAN that includes
host 1 and host 2. If host 1 and host 2 acquire their IP addresses from the DHCP server connected to device A,
only device A binds the IP-to-MAC address of host 1. If the interface between device A and device B is
untrusted, the ARP packets from host 1 are dropped by device B and connectivity between host 1 and host 2
is lost.
If you configure interfaces as trusted when they should be untrusted, you may open a security hole in a network.
If device A is not running DAI, host 1 can easily poison the ARP cache of device B (and host 2, if you
configured the link between the devices as trusted). This condition can occur even though device B is running
DAI.
DAI ensures that hosts (on untrusted interfaces) connected to a device that runs DAI do not poison the ARP
caches of other hosts in the network; however, DAI does not prevent hosts in other portions of the network
from poisoning the caches of the hosts that are connected to a device that runs DAI.
If some devices in a VLAN run DAI and other devices do not, the guidelines for configuring the trust state
of interfaces on a device that runs DAI become the following:
Interfaces that are connected to hosts
Interfaces that are connected to devices
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
Interface Trust States and Network Security
391