TechKnowSurge
Cisco CCNA 5.7 Cisco CCNA 4.3
TechKnowSurge Catalog Videos DEMO: Dynamic ARP Inspection (DAI)
VideoNetworkFree

DEMO: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) is a network security feature that protects against ARP-based attacks by validating ARP packets against a trusted DHCP snooping binding database. This coverage walks through enabling and configuring DAI on a managed switch, including trust assignments and validation rules.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Many core networking protocols were developed in an era when malicious actors and network-based attacks were not a primary concern, and ARP is a prime example of a protocol that lacks built-in security. This makes it susceptible to spoofing and poisoning attacks, which can allow an attacker to intercept or redirect traffic on a local network segment. Dynamic ARP Inspection is a mitigation technique implemented at the switch level that addresses this vulnerability by validating ARP traffic before it is allowed onto the network. DAI works in conjunction with DHCP snooping, relying on the binding database that DHCP snooping maintains to verify the legitimacy of ARP packets. The configuration process begins with enabling DHCP snooping globally on the switch and scoping it to the relevant VLANs. Once snooping is active, specific ports — typically uplinks or port channels connecting to trusted infrastructure — must be marked as trusted for both DHCP snooping and ARP inspection, since all ports are untrusted by default. With trust relationships established, DAI can be further refined by configuring validation checks that examine specific fields within each ARP packet. The available validation options include the destination MAC address, the source MAC address, and the IP address, and all three can be applied simultaneously by specifying them in a single command. Once enabled, the switch actively inspects ARP traffic against these criteria, dropping any packets that fail validation and helping ensure that only legitimate ARP communication occurs across the network.

What you'll learn

What's covered

Dynamic ARP Inspection (DAI)

Aligned to

Cisco CCNA
5.7 Configure and verify Layer 2 security features
4.3 Explain the role of DHCP and DNS within the network

Key terms

Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Dynamic Host Configuration Protocol
DHCP
A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Dynamic ARP Inspection
DAI
A security feature on managed switches that validates ARP messages against the DHCP snooping binding database, dropping packets with invalid IP-to-MAC address mappings.
DHCP Snooping
A switch security feature that classifies ports as trusted (connected to legitimate DHCP servers) or untrusted (connected to end devices) and drops DHCP server responses received on untrusted ports. It builds a binding database of valid IP-to-MAC-to-port mappings used by other Layer 2 security features like Dynamic ARP Inspection.

Topics

Dynamic Arp Inspection Dhcp Snooping Arp Spoofing Layer 2 Security Cisco Ios Network Security Networking

Transcript

When many of these protocols were created, they weren't really created with security in mind. The idea when these were created wasn't that there's hackers out there trying to hack your network. So many of these protocols, such as ARP, are really insecure, and we have to figure out ways to lock down these protocols. Dynamic ARP inspection is one of those protocols that allows us to lock down the ARP protocol and make sure that there are only legitimate ARP replies that are happening on our network.

Turning on DHCP snooping

Dynamic ARP inspection uses the binding database with DHCP snooping, so the first thing that we have to do is turn on DHCP snooping. What I'm going to do is go into the global configuration mode on switch CP snooping to turn that on from a global perspective. Then I'll type in IP DHCP snooping, and we're going to turn it on for VLAN 10. And we'll do that for also VLAN 10.

Trusting ports

So now it is turned on, but by default all of our ports are untrusted, so we need to start trusting some of those ports. I'm going to get into the interface, and for this I'm going to get into our port channels, so port channel, and then we'll do port channel 1 here. Inside this we're going to do IP DHCP snooping. This doesn't have to do specifically with DAI, but if we're going to trust it with DAI then we might as well do it with DHCP snooping as well. So I'm going to do that, and then I'm going to do an IP ARP inspection and trust this port as well. We want to do this maybe for some of my other ports on here as well.

Choosing what to validate

So I've got that. Now one last command that we can take a look at is what we want it to inspect. So I can do an IP ARP inspection, and what do we want it to validate? I'll do a validate with a question mark, and I can do a destination-mac, an IP, or a source-mac. So it's going to validate these different components out of that ARP.

So what I'm going to do is, if I do a destination-mac and I hit enter here, it would just be the destination MAC. Then I can do IP also, but if I add this it's actually going to take the place of the destination MAC. So if I want to do multiple of these, then what I have to do is put all of them in there. I'm going to do destination-mac space IP space source-mac and then hit enter, and then all three of those are going to go into this device, and it's going to inspect all three of those. So now dynamic ARP inspection is turned on on this device.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →