Dai Configuration Guidelines And Restrictions; Configuring Dai - Cisco 7604 Configuration Manual

DAI Configuration Guidelines and Restrictions

DAI Configuration Guidelines and Restrictions
When configuring DAI, follow these guidelines and restrictions:
•
•
•
•
•
•
•
•

Configuring DAI

These sections describe how to configure DAI:
•
•
•
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
38-6
DAI is an ingress security feature; it does not perform any egress checking.
DAI is not effective for hosts connected to routers that do not support DAI or that do not have this
feature enabled. Because man-in-the-middle attacks are limited to a single Layer 2 broadcast
domain, separate the domain with DAI checks from the one with no checking. This action secures
the ARP caches of hosts in the domain enabled for DAI.
DAI depends on the entries in the DHCP snooping binding database to verify IP-to-MAC address
bindings in incoming ARP requests and ARP responses. Make sure to enable DHCP snooping to
permit ARP packets that have dynamically assigned IP addresses. For configuration information, see
Chapter 37, "Configuring DHCP Snooping."
When DHCP snooping is disabled or in non-DHCP environments, use ARP ACLs to permit or to
deny packets.
DAI is supported on access ports, trunk ports, EtherChannel ports, and private VLAN ports.
A physical port can join an EtherChannel port channel only when the trust state of the physical port
and the channel port match. Otherwise, the physical port remains suspended in the port channel. A
port channel inherits its trust state from the first physical port that joins the channel. Consequently,
the trust state of the first physical port need not match the trust state of the channel.
Conversely, when you change the trust state on the port channel, the router configures a new trust
state on all the physical ports that comprise the channel.
The operating rate for the port channel is cumulative across all the physical ports within the channel.
For example, if you configure the port channel with an ARP rate-limit of 400 pps, all the interfaces
combined on the channel receive an aggregate 400 pps. The rate of incoming ARP packets on
EtherChannel ports is equal to the sum of the incoming rate of packets from all the channel
members. Configure the rate limit for EtherChannel ports only after examining the rate of incoming
ARP packets on the channel-port members.
The rate of incoming packets on a physical port is checked against the port-channel configuration
rather than the physical-ports configuration. The rate-limit configuration on a port channel is
independent of the configuration on its physical ports.
If the EtherChannel receives more ARP packets than the configured rate, the channel (including all
physical ports) is placed in the error-disabled state.
Make sure to limit the rate of ARP packets on incoming trunk ports. Configure trunk ports with
higher rates to reflect their aggregation and to handle packets across multiple DAI-enabled VLANs.
You also can use the ip arp inspection limit none interface configuration command to make the rate
unlimited. A high rate-limit on one VLAN can cause a denial-of-service attack to other VLANs
when the software places the port in the error-disabled state.
Enabling DAI on VLANs, page 38-7
Configuring the DAI Interface Trust State, page 38-8
Applying ARP ACLs for DAI Filtering, page 38-8
Chapter 38 Configuring Dynamic ARP Inspection
OL-4266-08