Dell PowerConnect B-RX - Limits and Restrictions; Configuring DAI

BigIron RX Series Configuration Guide 1003
53-1002253-01
Dynamic ARP inspection
35
• Inspection ARP – statically configured IP/MAC mapping, where the port is initially unspecified.
The actual physical port mapping will be resolved and updated from validated ARP packets.
Refer to “Configuring an inspection ARP entry” on page 1004.
• DHCP-Snooping ARP – information collected from snooping DHCP packets when DHCP
snooping is enabled on VLANs.
The status of an ARP entry is either pending or valid:
• Valid – the mapping is valid, and the port is resolved. This is always the case for static ARP
entries.
• Pending – for normal dynamic, inspection ARP, and DHCP-Snooping ARP entries before they
are resolved, and the port mapped. Their status changes to valid when they are resolved, and
the port mapped.
Refer to “System reboot and the binding database” on page 1007.
Limits and restrictions
The following limits and restrictions apply when configuring DAI:
• The maximum number of DHCP and static DAI entries depends on the maximum number of
ARP table entries allowed on the device. The BigIron RX Series switch can have up to 64,000
ARP entries. In a BigIron RX switch, you can use the system-max ip-arp command to change the
maximum number of ARP entries for the device.
• The current implementation works on routing and virtual routing interface ports, and does not
support Layer 2 switching-only ports in VLANs without an assigned IP address on the router.
Configuring DAI
Configuring DAI consists of the following steps.
1. Configure inspection ARP entries for hosts on untrusted ports. Refer to “Configuring an
inspection ARP entry” on page 1004.
2. Enable DAI on a VLAN to inspect ARP packets. Refer to “Enabling DAI on a VLAN” on
page 1004.
3. Configure the trust settings of the VLAN members. ARP packets received on trusted ports
bypass the DAI validation process. ARP packets received on untrusted ports go through the DAI
validation process. Refer to “Enabling trust on a port” on page 1004.
4. Enable DHCP snooping to populate the DHCP snooping IP-to-MAC binding database.
The following shows the default settings of DAI.
Feature Default
Dynamic ARP Inspection Disabled
Trust setting for ports Untrusted