Dell FCX624-E Laptop User Manual


  Open as PDF
of 1494
 
1346 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Dynamic ARP inspection
39
How DAI works
DAI allows only valid ARP requests and responses to be forwarded.
A Dell PowerConnect device on which DAI is configured does the following:
Intercepts ARP packets received by the system CPU
Inspects all ARP requests and responses received on untrusted ports
Verifies that each of the intercepted packets has a valid IP-to-MAC address binding before
updating the local ARP table, or before forwarding the packet to the appropriate destination
Drops invalid ARP packets
When you enable DAI on a VLAN, by default, all member ports are untrusted. You must manually
configure trusted ports. In a typical network configuration, ports connected to host ports are
untrusted. You configure ports connected to other switches or routers as trusted.
DAI inspects ARP packets received on untrusted ports, as shown in Figure 175. DAI carries out the
inspection based on IP-to-MAC address bindings stored in a trusted binding database. For the
Brocade device, the binding database is the ARP table, which supports DAI, DHCP snooping, and IP
Source Guard. To inspect an ARP request packet, DAI checks the source IP and source MAC
address against the ARP table. For an ARP reply packet, DAI checks the source IP, source MAC,
destination IP, and destination MAC addresses. DAI forwards the valid packets and discards those
with invalid IP-to-MAC address bindings.
When ARP packets reach a trusted port, DAI lets them through, as shown in Figure 175.
FIGURE 175 Dynamic ARP inspection at work
ARP entries
DAI uses the IP/MAC mappings in the ARP table to validate ARP packets received on untrusted
ports.
ARP entries in the ARP table derive from the following:
Dynamic ARP – normal ARP learned from trusted ports.
Static ARP – statically configured IP/MAC/port mapping.
Inspection ARP – statically configured IP/MAC mapping, where the port is initially unspecified.
The actual physical port mapping will be resolved and updated from validated ARP
packets.Refer to “Configuring an inspection ARP entry” on page 1348.
ARP
packet
ARP
packet
Switch
Trusted
Untrusted
DAI