420 Configuring Switching InformationDynamic ARP InspectionDynamic ARP Inspection (DAI) is a security feature that rejects invalid and malicious ARP packets. DAIprevents a class of man-in-the-middle attacks, where an unfriendly station intercepts traffic for otherstations by poisoning the ARP caches of its unsuspecting neighbors. The miscreant sends ARP requestsor responses mapping another station’s IP address to its own MAC address.DAI relies on DHCP snooping. DHCP snooping listens to DHCP message exchanges and builds abinding database of valid {MAC address, IP address, VLAN, and interface} tuples.When DAI is enabled, the switch drops ARP packets whose sender MAC address and sender IP addressdo not match an entry in the DHCP snooping bindings database. You can optionally configure additionalARP packet validation.The Dynamic ARP Inspection menu page contains links to the following features:• DAI Global Configuration• DAI Interface Configuration• DAI VLAN Configuration• DAI ACL Configuration• DAI ACL Rule Configuration• DAI StatisticsDAI Global ConfigurationUse the DAI Configuration page to configure global DAI settings.To display the DAI Configuration page, click Switching →Dynamic ARP Inspection →GlobalConfiguration in the navigation tree.Table 7-57. Link Dependency CommandsCLI Command Descriptionlink-dependency group Enters the link-dependency mode to configure a link-dependencygroup.add ethernet Adds member Ethernet port(s) to the dependency list.add port-channel Adds member port-channels to the dependency list.depends-on ethernet Adds the dependent Ethernet ports list.depends-on port-channel Adds the dependent port-channels list.show link-dependency Shows the link dependencies configured on a particular group.
