Configuring Dai; Configuration Notes And Feature Limitations - Dell PowerConnect B-FCXs Configuration Manual

•
The status of an ARP entry is either pending or valid:
•
•
Refer to also

Configuration notes and feature limitations

The following limits and restrictions apply when configuring DAI:
•
•
•
•
•

Configuring DAI

Configuring DAI consists of the following steps.
1. Configure inspection ARP entries for hosts on untrusted ports.Refer to
2. Enable DAI on a VLAN to inspect ARP packets.Refer to
3. Configure the trust settings of the VLAN members. ARP packets received on trusted ports
4. Enable DHCP snooping to populate the DHCP snooping IP-to-MAC binding database.
The following shows the default settings of DAI.
PowerConnect B-Series FCX Configuration Guide
53-1002266-01
DHCP-Snooping ARP – information collected from snooping DHCP packets when DHCP
snooping is enabled on VLANs.
Valid – the mapping is valid, and the port is resolved. This is always the case for static ARP
entries.
Pending – for normal dynamic and inspection ARP entries before they are resolved, and the
port mapped. Their status changes to valid when they are resolved, and the port mapped.
"System reboot and the binding database"
To run Dynamic ARP Inspection, you must first enable support for ACL filtering based on VLAN
membership or VE port membership. To do so, enter the following commands at the Global
CONFIG Level of the CLI.
PowerConnect(config)#enable ACL-per-port-per-vlan
PowerConnect(config)#write memory
PowerConnect(config)#exit
PowerConnect#reload
NOTE
You must save the configuration and reload the software to place the change into effect.
Dell recommends that you do not enable DAI on a trunk port.
The maximum number of DHCP and static DAI entries depends on the maximum number of
ARP table entries allowed on the device. A Layer 2 switch can have up to 256 ARP entries and
a Layer 3 switch can have up to 64,000 ARP entries. In a Layer 3 switch, you can use the
system-max ip-arp command to change the maximum number of ARP entries for the device.
However, only up to 1024 DHCP entries can be saved to flash.
ACLs are supported on member ports of a VLAN on which DHCP snooping and Dynamic ARP
Inspection (DAI) are enabled.
DAI is supported on a VLAN without a VE, or on a VE with or without an assigned IP address.
inspection ARP entry" on page 1348.
bypass the DAI validation process. ARP packets received on untrusted ports go through the
DAI validation process.Refer to
on page 1351.
"Enabling DAI on a VLAN"
"Enabling trust on a port"
Dynamic ARP inspection
"Configuring an
on page 1348.
on page 1348.
39
1347