Limits And Restrictions; Configuring Dai - Dell PowerConnect B-RX Configuration Manual

ARP entries
DAI uses the IP/MAC mappings in the ARP table to validate ARP packets received on untrusted
ports.
ARP entries in the ARP table derive from the following:
•
•
•
•
The status of an ARP entry is either pending or valid:
•
•
Refer to

Limits and restrictions

The following limits and restrictions apply when configuring DAI:
•

Configuring DAI

Configuring DAI consists of the following steps.
1. Configure inspection ARP entries for hosts on untrusted ports. Refer to
2. Enable DAI on a VLAN to inspect ARP packets. Refer to
3. Configure the trust settings of the VLAN members. ARP packets received on trusted ports
4. Enable DHCP snooping to populate the DHCP snooping IP-to-MAC binding database.
The following shows the default settings of DAI.
Feature
Dynamic ARP Inspection
Trust setting for ports
BigIron RX Series Configuration Guide
53-1001810-01
Dynamic ARP – normal ARP learned from trusted ports.
Static ARP – statically configured IP/MAC/port mapping.
Inspection ARP – statically configured IP/MAC mapping, where the port is initially unspecified.
The actual physical port mapping will be resolved and updated from validated ARP packets.
Refer to "Configuring an inspection ARP entry"
DHCP-Snooping ARP – information collected from snooping DHCP packets when DHCP
snooping is enabled on VLANs.
Valid – the mapping is valid, and the port is resolved. This is always the case for static ARP
entries.
Pending – for normal dynamic, inspection ARP, and DHCP-Snooping ARP entries before they
are resolved, and the port mapped. Their status changes to valid when they are resolved, and
the port mapped.
"System reboot and the binding database"
The maximum number of DHCP and static DAI entries depends on the maximum number of
ARP table entries allowed on the device. The BigIron RX Series switch can have up to 64,000
ARP entries. In a BigIron RX, you can use the system-max ip-arp command to change the
maximum number of ARP entries for the device.
inspection ARP entry" on page 992.
bypass the DAI validation process. ARP packets received on untrusted ports go through the DAI
validation process. Refer to
on page 992.
on page 995.
"Enabling trust on a port"
Dynamic ARP inspection
"Configuring an
"Enabling DAI on a VLAN"
on page 992.
Default
Disabled
Untrusted
35
on page 992.
991