Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k

Dynamic ARP Inspection for non-DHCP Environment

Hi everyone,

I wish to deploy DAI (Dynamic ARP Inspection) for a non-DHCP Environment where all connected hosts are assigned with a static IP address.

ARP ACL as recommended in Cisco Docs can be used to achieve this so that ARP spoofing / poisoning can be mitigated.

This does not seem to be a scalable solution for my deployment scenario.

Multiple (more than 15) /25 Subnets,  presently having a different numbers of hosts in each subnet.

Prediction or probability of addition of new hosts in these subnets is also not possible. Hosts are added as per requirement.

Creation of ARP ACL manually seems to be working. But it requires manual configuration overhead and results in a lengthy multiple ACL entries.

Will "ip device-tracking" feature be helpful in some way for utilization with DAI for non-DHCP environment?       

Rajmohan R       

Rajmohan R
Everyone's tags (3)
2 REPLIES

Re:Dynamic ARP Inspection for non-DHCP Environment

Hello

static DAI is always checked first with or withput the dhcp snooping table but to have a dymanic setup I am on the understanding that dhcp snooping is required

res
paul

Sent from Cisco Technical Support Android App

Please don't forget to rate any posts that have been helpful. Thanks.

Dynamic ARP Inspection for non-DHCP Environment

Thanks Paul.

Does it means that IP Device tracing will be of no use in DAI implementation in non-dhcp environment.

Rajmohan R

Rajmohan R
417
Views
4
Helpful
2
Replies
CreatePlease to create content