> For the complete documentation index, see [llms.txt](https://trepa-technologies.gitbook.io/networking-technologies-by-johnny-bandin/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://trepa-technologies.gitbook.io/networking-technologies-by-johnny-bandin/layer-2-security/dynamic-arp-inspection.md).

# Dynamic ARP Inspection

#### The Address Resolution protocol is used to map Layer 3 to Layer 2 addresses in our networks. Endpoints and network devices will have a ARP Cache/Table for those mappings. In our networks someone malicious could spoof ARP replies and perform MITM attacks. this is called **"ARP Spoofing"**, we can authenticate ARP packets by implementing DAI (Dynamic ARP Inspection).

#### DAI in a DHCP environment will rely on the DHCP snooping binding database table to authenticate the Layer 3 - Layer 2 mappings in ARP requests and replies.

<figure><img src="https://2373667134-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8zF1bBBRr6t1PCyfuXHu%2Fuploads%2FrcgKz49OFrJzr0XoayYd%2Flayer_2_security_network_diagram.png?alt=media&amp;token=9b445e23-b4bc-4301-8671-e1b200afa4cc" alt=""><figcaption><p>Layer 2 Network Security Diagram</p></figcaption></figure>

## Configuration

#### For this guide we will first need to get our network ready by configuring VLANs, Trunks and DHCP snooping. If you do not know how to configure these technologies please refer to our other guides. To configure DAI follow the configuration below.

`SW3(config)#ip arp inspection vlan 10,20` # This command will enable ARP inspection for the specified VLANs. DAI will authenticate the Layer 2 and Layer 3 mappings for devices in your network to prevent spoofing.

<figure><img src="https://2373667134-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8zF1bBBRr6t1PCyfuXHu%2Fuploads%2Fk49WUqO2WplQ384d8Pak%2Fip_arp_inspection_configuration_01.png?alt=media&amp;token=a5794b88-b76b-4437-862a-ea2e6187481c" alt=""><figcaption><p>DAI Configuration</p></figcaption></figure>

<figure><img src="https://2373667134-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8zF1bBBRr6t1PCyfuXHu%2Fuploads%2FufUOV8bU30XGJ2eOHCZB%2Fip_arp_inspection_configuration.png?alt=media&amp;token=cbd26438-6c9e-4eed-aa66-32a9626bd9db" alt=""><figcaption><p>DAI configuration</p></figcaption></figure>

#### Verification. Now that we have enabled DAI on all our switches lets clear the arp cache in our DHCP server and resend the DHCP request from our clients.

`R1#clear arp` # This command will clear the ARP table in our Cisco iOS router.

<figure><img src="https://2373667134-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8zF1bBBRr6t1PCyfuXHu%2Fuploads%2FDPK33cKvILcu0AdQvPP8%2Fclear_arp.png?alt=media&amp;token=9a3c992d-acd0-4999-997a-2b9e2b62f0aa" alt=""><figcaption><p>clear arp command</p></figcaption></figure>

<figure><img src="https://2373667134-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8zF1bBBRr6t1PCyfuXHu%2Fuploads%2FtK5oNEKxFPPaq6CI8by8%2FDAI_log_message.png?alt=media&amp;token=a63965b0-b767-45f3-b80c-16bf99ee17b9" alt=""><figcaption><p>DAI log Message showing the invalid ARPs</p></figcaption></figure>

#### Here we can see an error message for our DHCP server. This is because the DHCP server is a static address and is not in our DHCP snooping binding table. We can fix this issue with an **"ARP ACL"** or by configuring the **"ARP Trust"** command on interfaces facing the DHCP server.

`SW3(config)#interface eth0/0` # Brings you into the interface subconfiguration mode

`SW3(config-if)#ip arp inspection trust` # This command allows ARP packets to be authenticated without the L2-L3 mappings being in the DHCP snooping table

`SW2(config)#arp access-list DAI` # This command creates an ACL specifically for ARP packets

`SW2(config-arp-acl)#permit ip host 10.10.10.254 host aabb.cc00.8000` # This command permits a specific host on the ARP ACL

`SW2(config-arp-acl)#permit ip host 10.10.20.254 host aabb.cc00.8000` # This command permits a specific host on the ARP ACL

`SW2(config)#ip arp inspection filter DAI vlan 10,20` # This command will apply the the ARP ACL for the specified VLANs.

#### Full configuration below

<figure><img src="https://2373667134-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8zF1bBBRr6t1PCyfuXHu%2Fuploads%2F8oheshfSMermSych9W6J%2Fip_arp_inspection_trust_cmd.png?alt=media&amp;token=4dffcd35-952c-4700-bdf3-a2c129b76f69" alt=""><figcaption><p>DAI trust command</p></figcaption></figure>

<figure><img src="https://2373667134-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8zF1bBBRr6t1PCyfuXHu%2Fuploads%2FvhXYHImM7zTGJPKSik3C%2Farp_acl.png?alt=media&amp;token=673319b6-3b4a-41cb-9216-fc417bdef36f" alt=""><figcaption><p>ARP ACL Configuration</p></figcaption></figure>

#### Show commands

<figure><img src="https://2373667134-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8zF1bBBRr6t1PCyfuXHu%2Fuploads%2F5rZ2QkZWhWY2q0fyN5BS%2Fshow_ip_arp_inspection.png?alt=media&amp;token=1f002b2d-0310-46ce-b2f4-4502904e0ee8" alt=""><figcaption><p>show ip arp inspection command and output</p></figcaption></figure>