Dynamic ARP Inspection — Validation Checks

Bundle lab

Harden Dynamic ARP Inspection (DAI) on an access switch by enabling additional packet validation checks: source MAC, destination MAC, and IP sanity. The uplink toward the DHCP server/gateway is trusted, access ports are untrusted. DHCP Snooping and baseline DAI are already enabled for VLAN 10; your task is to add the global DAI validation knobs and verify the change deterministically via show commands.

Learning objectives

• Explain how DAI leverages the DHCP Snooping binding table to verify ARP packets.
• Enable additional DAI validation checks (source MAC, destination MAC, and IP) to catch malformed or forged ARP frames.
• Verify DAI configuration and validation policy with show commands.
• Differentiate trusted vs. untrusted ports at the access edge and keep the trust boundary on the uplink.

Troubleshooting focus

• If legitimate ARP packets are dropped, verify the uplink toward the DHCP server/gateway is trusted for both DHCP Snooping and DAI.
• Confirm DHCP Snooping is enabled globally and for VLAN 10 so the DAI binding table can populate deterministically from config intent.
• Check that only the uplink is trusted; access ports must remain untrusted to prevent rogue DHCP/ARP sources.
• Review the DAI validation policy; enabling src-mac/dst-mac/ip will drop malformed frames that may appear during host boot or mis-cabling.
• Ensure host access ports are in the correct VLAN and the trunk carries VLAN 10 to the router-on-a-stick gateway.