26-6
Cisco IE 2000 Switch Software Configuration Guide
OL-25866-01
Chapter 26 Configuring Dynamic ARP Inspection
How to Configure Dynamic ARP Inspection
Note Do not enable DAI on RSPAN VLANs. If DAI is enabled on RSPAN VLANs, DAI packets might
not reach the RSPAN destination port.
• A physical port can join an EtherChannel port channel only when the trust state of the physical port
and the channel port match. Otherwise, the physical port remains suspended in t he port channel. A
port channel inherits its trust state from the first physical port that joins the channel. Consequently,
the trust state of the first physical port need not match the trust state of the channel.
Conversely, when you change the trust state on the port channel, the switch configures a new trust
state on all the physical ports that comprise the channel.
• The operating rate for the port channel is cumulative across all the physical ports within the channel.
For example, if you configure the port channel with an ARP rate-limit of 400 pps, all the interfaces
combined on the channel receive an aggregate 400 pps. The rate of incoming ARP packets on
EtherChannel ports is equal to the sum of the incoming rate of packets from all the channel
members. Configure the rate limit for EtherChannel ports only after examining the rate of incom ing
ARP packets on the channel-port members .
The rate of incoming packets on a physical port is checked against the port-channel configuration
rather than the physical-ports configuration. The rate-limit configuration on a port channel is
independent of the configuration on its physical ports.
If the EtherChannel receives more ARP packets than the configured rate, the channel (including all
physical ports) is placed in the error-disabled state.
• Make sure to limit the rate of ARP packets on incoming trunk ports. Configure trunk ports with
higher rates to reflect their aggregation and to handle packets acros s multiple DAI-enabled VLANs.
You also can use the ip arp inspection limit none interface configuration command to make the rate
unlimited. A high rate-limit on one VLAN can cause a denial-of-service attack to other VLANs
when the software places the port in the error-disabled state.
• When you enable DAI on the switch, policers that were configured to police ARP traffic are no
longer effective. The result is that all ARP traffic is sent to the CPU.
How to Configure Dynamic ARP Inspection

Configuring Dynamic ARP Inspection in DHCP Environments

This procedure shows how to configure DAI when two switches support this feature. Host 1 i s connected
to Switch A, and Host 2 is connected to Switch B as shown in Figure 26-2 on page 26-3. Both switches
are running DAI on VLAN 1 where the hosts are located. A DHCP server is connected to Switch A. Both
hosts acquire their IP addresses from the same DHCP server. Therefore, Switch A has the bindings for
Host 1 and Host 2, and Switch B has the binding for Host 2.
Before You Begin
You must perform this procedure on both switches. This procedure is required.
Command Purpose
Step 1 show cdp neighbors Verifies the connection between the switches.
Step 2 configure terminal Enters global configuration mode.