Dynamic ARP Inspection

How ARP works 

Network devices need the IP and MAC address of the hosts they communicate with. ARP determines the MAC address associated with an IP address. Each device stores these IP-to-MAC bindings in its ARP cache. 

Consider this: 

• Host A wants to communicate with Host B. 

• Host A does not have Host B's MAC address in its ARP cache. 

• Host A broadcasts an ARP request to all hosts in the LAN segment. 

• All hosts in the broadcast domain receive the request. 

• Only Host B responds with its MAC address. 

How ARP spoofing attacks work 

ARP spoofing is a form of man-in-the-middle attack. It lets an attacker intercept traffic intended for other hosts. 

The attacker sends crafted ARP packets that poison the ARP cache on network devices. The attacker poisons the ARP caches of end hosts, switches, and firewalls on a LAN segment. This redirects traffic to the attacker's machine. 

The example below shows how this attack happens: 

• Hosts A, B, and C connect to the switch on ports 1, 2, and 3 respectively. 

• Host A needs to communicate with Host B. It broadcasts an ARP request for 10.10.10.20, the IP address of Host B. 

• Host B responds. The switch and Host A populate their ARP caches with a binding for IP address 10.10.10.20 and MAC address bb:bb:bb:bb:bb:bb. The switch learns the MAC address of Host B on port 2. 

• Host C poisons the ARP cache of the switch and Host A. It broadcasts forged ARP responses. These packets falsely claim that IP address 10.10.10.20 exists on cc:cc:cc:cc:cc:cc. 

• Host A and the switch now use the MAC address "cc:cc.." as the destination for traffic intended for Host B. 

• The switch forwards all traffic toward 10.10.10.20 to port 3. Host C intercepts that traffic. 

Host C has now inserted itself into the traffic stream from Host A to Host B. This is a classic man-in-the-middle attack. 

How DAI works 

DAI associates a trust state with every port on the switch: 

• Trusted ports are excluded from DAI validation checks. All ARP traffic is permitted. 

• Untrusted ports are subject to DAI validation checks. The switch examines ARP requests and responses received on those ports. 

DAI compares the IP-to-MAC binding information in ARP packets to the DHCP snooping table. If no IP-to-MAC entry in the table matches the ARP packet, DAI drops the packet. DAI does not update the local ARP cache with that information. 

Supported models and firmware 

DAI is supported on the following models. The minimum required firmware is the oldest version that supports this functionality on the platform. It is not the same as the recommended firmware. Meraki recommends using the latest GA or RC firmware release for this feature. 

DHCP requirement 

DAI relies on DHCP snooping table information to perform validation. 

DAI blocks static IP addresses 

DAI blocks static IP addresses configured directly on devices. This is expected behavior. These events are tracked in the DHCP Tracker folder. 

Allow entries flagged incorrectly 

DAI may flag a client incorrectly. In this case, add the entry to the Allow list so the traffic is not dropped. 

Allowing an entry adds it to the DHCP snooping table as a valid snoop entry. This ties the MAC address of the client to the IP address in the table. DAI no longer flags the traffic as invalid or malicious. 

To allow a blocked entry: 

1. Refer to Switching > Monitor > DHCP servers & ARP. 

2. In the DAI Blocked Events, select the entry you wish to allow. 

3. Select Move to allow list. 

The selected entry now appears under the Allow listed snoop entries section. Traffic from this MAC address using this IP address is no longer blocked by DAI.