Validate ARP on ingress
DAI checks ARP requests and replies arriving on untrusted ports in a protected VLAN. It compares address claims against valid bindings, commonly learned by DHCP snooping. An invalid ARP claim is dropped before other hosts can learn the forged mapping.
On Cisco switches, a trusted interface bypasses these DAI checks. Static IPv4 hosts can use explicit ARP rules supported by the switch. If a legitimate host has no matching binding or rule, its ARP traffic can be dropped even when the port and DHCP server are healthy.
Try it in a lab
- In a lab VLAN with DHCP snooping, let a host obtain a lease and verify its binding. Enable ARP inspection and confirm that valid ARP and ordinary connectivity still work from the host port.
- On the isolated test link, send an ARP message claiming a different host’s IP with the wrong MAC address. Check the DAI drop counter and confirm that the receiving host retains its legitimate mapping.