Dynamic ARP Inspection (DAI)

Notes on Dynamic ARP Inspection, showing an ARP poisoning demo and the commands to enable DAI and trust uplink interfaces on Cisco switches.

ARP Poisoning

ARP poisoning, where a gratuitous ARP claiming the gateway address puts the attacker in the middle of the client and the router

DAI

SW1(config)#interface vlan 1
SW1(config-if)#ip address 192.168.7.1 255.255.255.0
SW1(config-if)#no shutdown 
SW1#show interfaces vlan 1 | i bia
  Hardware is Ethernet SVI, address is 0097.81b6.8001 (bia 0097.81b6.8001)

SW2-Client#ping 192.168.7.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.7.1, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 4/5/7 ms
SW2-Client#show arp 192.168.7.1
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.7.1             0   0097.81b6.8001  ARPA   Vlan1

Now the attacker does ARP poisoning. Let us see again the ARP table of the client:

SW2-Client#show arp 192.168.7.1
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  192.168.7.1             0   b826.ebc5.a07e  ARPA   Vlan1

DAI Configuration

SW1(config)#ip arp inspection vlan 1

Then all interfaces in vlan 1 become untrusted. Then:

• DAI intercepts ARP requests and replies on untrusted interfaces.
• Limits the number of incoming ARP packets to 15 per second on an untrusted interface.
• Compares contents with the DHCP snooping binding database.

Trusted interfaces are usually uplinks.

SW1(config)#interface gigabitEthernet 3/3  
SW1(config-if)#ip arp inspection trust

Trusted ports:

• DAI does NOT inspect incoming ARP packets on trusted interfaces

Note: DAI does NOT inspect outgoing ARP packets on any interface