DAI (Dynamic ARP Inspection)

[lagapidis (Lazarus Agapidis)]

Hello Daniel

@dlais1987

Is this because the DHCP snooping database would only have dynamically assigned addresses and not the static address of the dhcp?

Yes, the DHCP snooping database will only have addresses that are either assigned by DHCP or are statically configured in the DHCP database. If you statically assign a host on the network an IP address, the DHCP snooping database has no way of knowing that that address has been assigned. The only way to do it is to statically configure it in the DHCP router.

@dlais1987

And also when the lesson says not to use the static command I dont understand why it is bad to only check the arp list? Would this then negate the checking of all the dynamically assigned addresses?

Yes, that is correct. It will only check the statically configured ARP ACL and NOT the dynamically created and updated DHCP snooping database.

@dlais1987

and lastly,
in the picture attached for example configuration there is no commands for the below which I thought must be added

Yes, the last ip arp inspection filter command does not seem to be included in the configuration of SW1 at the end. I will let Rene know to add that…

I hope this has been helpful!

Laz