Dynamic ARP Inspection (DAI) working principle and test

I. Working principle:

A. To determine the MAC address of an illegal access in a network based on a DHCP snooping or manual form of MAC address and IP address binding table

B. At the same time, to prevent malicious ARP spoofing, you can also limit the ARP request packets of the interface

---Test found that ARP requests and replies for untrusted ports (including unreasonable ARP) are discarded, so it is not necessary to make a speed limit on a untrusted port (no manual modification of the DHCP binding table, or exclusion with ARP access-list).

Reference Link: http://wenku.baidu.com/view/cda2e815c5da50e2534d7f05.html

Two. Test topology:

Test switch iOS:

--cisco IOS Software, C3560 Software (c3560-ipservicesk9-m), Version 12.2 (+) SE3, release Software (FC1)

Three. Configuration steps:

A. Switches:

① Global Open DHCP snooping

IPDHCP snooping

② DHCP snooping enabled on VLAN 11

IPDHCP Snooping VLAN 11

③ specifies that the interface to the R2 (DHCP server) is a trusted interface

Interface FASTETHERNET0/2

IP DHCP snooping Trust

④ on the VLAN 11 to open Dai

ip arp inspection vlan 11

B.DHCP Server configuration:

① Set IP address pool

IP DHCP Pool dhcppool

Network 10.1.1.0 255.255.255.0

Default-router 10.1.1.2

② Trust 82 option

Interface gigabitethernet0/0

IP DHCP relay information trusted