Dynamic Arp Inspection (Dai) - Avaya 8800 Planning And Engineering, Network Design

• Trusted: ports, such as switch-to-switch and DHCP server ports, that are configured to receive
messages only from within the network. All types of DHCP messages are allowed.
To eliminate the capability to set up rogue DHCP servers on untrusted ports, the untrusted ports
allow DHCP request packets only. DHCP replies and all other types of DHCP messages from
untrusted ports are dropped.
DHCP snooping verifies the source of DHCP packets as follows:
• When the switch receives a DHCP request on an untrusted port, DHCP snooping compares
the source MAC address and the DHCP client hardware address. If the addresses match, the
switch forwards the packet. If the addresses do not match, the switch drops the packet.
• When the switch receives a DHCP release or DHCP decline broadcast message from a client,
DHCP snooping verifies that the port on which the message was received matches the port
information for the client MAC address in the DHCP binding table. If the port information
matches, the switch forwards the DHCP packet.
DHCP snooping supports MLT/SMLT ports as trusted ports only.
DHCP binding table
DHCP snooping dynamically creates and maintains an IP-to-MAC binding table. The DHCP binding
table includes the following information about DHCP leases on untrusted interfaces:
• source MAC address
• IP address
• lease duration
• time to expiry
• VLAN ID
• port
You can also configure static DHCP binding entries. Dynamic binding entries are lost after a restart.
For more information about DHCP snooping, see Avaya Ethernet Routing Switch 8800/8600
Security (NN46205-601).

Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets in the network. It
intercepts, discards, and logs ARP packets with invalid IP-to-MAC address bindings.
Without Dynamic ARP inspection, a malicious user can attack hosts, switches, and routers
connected to the Layer 2 network by poisoning the ARP caches of systems connected to the subnet
and by intercepting traffic intended for other hosts on the subnet (man-in-the-middle attacks).
Dynamic ARP Inspection prevents this type of attack.
June 2016 Planning and Engineering — Network Design
Comments on this document? infodev@avaya.com
Data plane security
275