Cisco WS-SUP32-GE-3B Software Configuration Guide - Page 510

Configuring DAI Chapter 35 Configuring Dynamic ARP Inspection • When DHCP snooping is disabled or in non-DHCP environments, use ARP ACLs to permit or to deny packets. • DAI is supported on access ports, trunk ports, EtherChannel ports, and private VLAN ports. • A physical port can join an EtherChannel port channel only when the trust state of the physical port and the channel port match. Otherwise, the physical port remains suspended in the port channel. A port channel inherits its trust state from the first physical port that joins the channel. Consequently, the trust state of the first physical port need not match the trust state of the channel. Conversely, when you change the trust state on the port channel, the switch configures a new trust state on all the physical ports that comprise the channel. • The operating rate for the port channel is cumulative across all the physical ports within the channel. For example, if you configure the port channel with an ARP rate limit of 400 pps, all the interfaces combined on the channel receive an aggregate 400 pps. The rate of incoming ARP packets on EtherChannel ports is equal to the sum of the incoming rate of packets from all the channel members. Configure the rate limit for EtherChannel ports only after examining the rate of incoming ARP packets on the channel-port members. The rate of incoming packets on a physical port is checked against the port-channel configuration rather than the physical-ports configuration. The rate-limit configuration on a port channel is independent of the configuration on its physical ports. If the EtherChannel receives more ARP packets than the configured rate, the channel (including all physical ports) is placed in the error-disabled state. • Make sure to limit the rate of ARP packets on incoming trunk ports. Configure trunk ports with higher rates to reflect their aggregation and to handle packets across multiple DAI-enabled VLANs. You also can use the ip arp inspection limit none interface configuration command to make the rate unlimited. A high rate-limit on one VLAN can cause a denial-of-service attack to other VLANs when the software places the port in the error-disabled state. Configuring DAI These sections describe how to configure DAI: • Enabling DAI on VLANs, page 35-7 • Configuring the DAI Interface Trust State, page 35-7 • Applying ARP ACLs for DAI Filtering, page 35-8 • Configuring ARP Packet Rate Limiting, page 35-9 • Enabling DAI Error-Disabled Recovery, page 35-10 • Enabling Additional Validation, page 35-11 • Configuring DAI Logging, page 35-12 • Displaying DAI Information, page 35-15 35-6 Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY OL-11439-03