Editing Cisco Commands (section)

== Dynamic ARP Inspection (DAI) ==
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets against a trusted database (typically built by DHCP Snooping) to prevent ARP spoofing and man-in-the-middle attacks. It intercepts ARP packets on untrusted ports, checks IP-to-MAC bindings, and drops invalid ones.

=== Enable DAI globally ===
Dynamic ARP Inspection requires DHCP Snooping to be enabled first (DAI uses the DHCP snooping binding table for validation).

 ip arp inspection

=== Enable DAI on a VLAN ===
Specify which VLANs should be protected.

 ip arp inspection vlan 10
 ip arp inspection vlan 20
 ip arp inspection vlan 10,20   (alternative: range)

=== Configure trusted interfaces ===
Trust uplinks and ports connected to other switches, routers, DHCP servers, or devices that should bypass DAI checks.

 interface GigabitEthernet0/1
  ip arp inspection trust

Trusted ports forward ARP packets without validation.

=== Untrusted interfaces (default) ===
Access ports are untrusted by default. Invalid ARP packets are dropped.

 interface GigabitEthernet0/2
  no ip arp inspection trust   (optional; this is the default)

=== Configure ARP rate limiting ===
Protect against ARP flooding/DoS attacks. Default is 15 pps on untrusted ports (exceeding this can put the port in err-disable).

 interface GigabitEthernet0/2
  ip arp inspection limit rate 15   (example: 15 packets per second)
  ip arp inspection limit rate 100 burst interval 1   (optional: higher rate with burst)

=== Additional Validation Checks ===
By default, DAI validates only IP-to-MAC bindings from the DHCP snooping database. Enable extra checks (global config mode) to catch malformed ARP packets (highly recommended for stronger security).

 ip arp inspection validate src-mac
 ip arp inspection validate src-mac dst-mac ip   (common: enable all three)

Options:
* '''src-mac''' — Checks source MAC in Ethernet header vs. sender MAC in ARP body (for requests and replies).
* '''dst-mac''' — Checks destination MAC in Ethernet header vs. target MAC in ARP body (mainly for replies).
* '''ip''' — Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, multicast IPs) in ARP body.

Each new <code>ip arp inspection validate</code> command '''overrides''' previous ones, so specify all desired options together.

To disable: <code>no ip arp inspection validate [src-mac] [dst-mac] [ip]</code>

=== Verify DAI status ===
 show ip arp inspection
 show ip arp inspection vlan 10
 show ip arp inspection interfaces
 show ip arp inspection statistics   (shows drops, rate limit violations)
 show ip arp inspection log   (logs of dropped packets)

=== Disable DAI ===
 no ip arp inspection
 no ip arp inspection vlan 10

=== Notes ===
* Requires '''DHCP Snooping''' to build the ARP binding table (enable with <code>ip dhcp snooping</code> + <code>ip dhcp snooping vlan ...</code>).
* Only trusted ports can send unlimited ARP replies/packets (no validation or rate limiting).
* Access ports should remain '''untrusted''' to enforce checks.
* Commonly deployed with '''PortFast + BPDU Guard''' on access ports for loop/spanning-tree protection.
* For non-DHCP environments, use static ARP ACLs: <code>ip arp inspection filter arp-acl-name vlan 10</code>.
* Often combined with '''IP Source Guard''' (<code>ip verify source</code>) on access ports to filter IP traffic based on the same bindings.
* Rate limiting helps prevent DoS; monitor with <code>show ip arp inspection statistics</code> and consider <code>errdisable recovery cause arp-inspection</code> for automatic port recovery.
* Additional validation (<code>src-mac</code>, <code>dst-mac</code>, <code>ip</code>) catches MAC spoofing or malformed packets beyond basic binding checks—enable at least <code>src-mac</code> and <code>ip</code> in most production setups.
* DAI is ingress-only (checks incoming packets on untrusted ports).