Dynamic ARP Inspection - Does it check port in the binding database?

Question

It is mentioned that DAI check for correct IP/MAC combination using the DHCP binding database. It is also mentioned that DAI is turned on for an entire VLan and not on a per port basis.

1. If PCA (macA,ipA) was originally connected to port1 ( binding - macA,ipA,port1 ) and PCA was relocated to port2 with its original macA,ipA.

Will DAI take port into consideration when checking the binding in the database? Will DAI block PCA now, since it is on port2 - but PCA (macA, ipA still remain the same)?

2. What's the point of having DAI when we can enable IP Source with port security?

====================

(Edited)

I have added a static binding using (e.g.)

"ip source binding xxx1.yyy1.zzz1 vlan4 192.168.1.1 interface gi1/0/1"

After which my host with the static ip (192.168.1.1) started to send traffic through since (DAI checked the DHCP binding database). (it is unable to send traffic before addin the static binding)

Once the traffic ping through, I move the connected port from gi1/0/1 to gi1/0/2 (since it is a static configuration), there is no dhcp involved and the static binding did not reflect the updated port (to gi1/0/2) and it still worked. ( I also done a arp -d on the host and ping to new host , so it will do an arp request )

q1) From the test above, can I conclude that DAI checks only IP/MAC combi but not the port ?

q2) I realize my static entry in ip source binding is not reflected in dhcp snoop binding table, so can I say that dhcp snoop binding table is a subset of the ip source binding table ? (since ip source binding contain static entry too) It also seems like the DAI references the source binding table (since my static entry works after adding it in), is there any difference between source binding and dhcp snoop table ?

q3) Lastly, I could not understand why when we activate ip source guard + port security, there is a need to turn on option82 in the switch ? Why would the adding of "port-security" require option 82 setting ? ?

Answer 1

Will DAI take port into consideration when checking the binding in the database ?

Since you don't mention platform or code version, generally speaking, when a host moves from P1 to P2, the host will still process DHCP and the DHCP snooping binding table will update to reflect P2. So even if a particular implementation does check use the port there should be no problem.

What I can't answer though is if you go a step further and add a dumb switch between the host and the managed switch running DHCP snooping/DAI. If you move the connection from the dumb switch to the managed switch, this often won't trigger the host to process DHCP again (i.e. the host's network connection didn't go down/up). Haven't tried this personally so not sure what would happen, but my guess would be that the switch may update the port on the DHCP snooping binding table when it updates the MAC address table. If I get a chance to test this at some point with my Cisco gear I will come back to edit this.

whats the point of having DAI when we can enable IP Source with port security ?

IP source guard prevents IP traffic that doesn't match the DHCP snooping binding table (or static entries). So if the traffic has no IP headers, it won't prevent any of the traffic.

Port security works by matching the MAC address to restrict access. If the MAC address matches, then the traffic will be allowed.

ARP is sent at L2 (no IP headers), so a host (compromised or not) with a MAC address that allows it to match port security could still perform attacks on ARP (i.e. ARP spoofing, poisoning, etc). DAI provides protection in this gap.

From the test above, can I conclude that DAI checks only IP/MAC combi but not the port ?

From the test above, you can conlude that DAI checks only the IP/MAC combination but not the port for that particular platform and software version only. This does not guarantee that DAI will have the same behavior on a different platform or with a different version of code.

I realize my static entry in ip source binding is not reflected in dhcp snoop binding table, so can I say that dhcp snoop binding table is a subset of the ip source binding table ?

For Cisco devices, it would not be totally inaccurate to say that, but I wouldn't say it that way as the phrasing gives the wrong impression. When stated as you put it, it almost makes it sound as if some of the entries from the IP source binding table are used to generate the DHCP snooping binding table.

You can say that the DHCP snooping binding table is one of the sources used to generate the IP source binding table.

is there any difference between source binding and dhcp snoop table ?

As you noted, the IP source binding table also includes static entries.

Lastly, I could not understand why when we activate ip source guard + port security, there is a need to turn on option82 in the switch ? Why would the adding of "port-security" require option 82 setting ? ?

When you add the MAC address source filtering to IP source guard using the ip verify source port-security command, the client MAC address is not learned until it has obtained a DHCP lease. Until then, all non-IP traffic except for DHCP will also be blocked.

Since the switch won't learn the MAC address of the client until after it obtains a lease, this leads to a problem of how does the switch know where to send the return DHCP traffic from the server to the client? The information inserted by DHCP option 82 gives this information to the switch. However you do need to make sure your DHCP server then also supports option 82.

Answer 2

1. What DAI does is to intercept and inspect all ARP request and reply packets on an untrusted port. If an ARP reply packet contains INVALID information/value (invalid IP_Address-to-MAC_Address, NOT invalid switch port), it will be dropped.

   Therefore, with only DAI feature enabled, you can move your host to different ports without facing any issue because it has valid IP_Address-to-MAC_Address binding.

2. IP Source Guard makes use of DHCP snooping database and static IP source binding entries. Therefore, DHCP snooping database is "SMALLER" than IP source binding database (with dhcp-snooping and static type entries).

   I would not use the word subset as it is not quite safe for me to say so, even though it looks like that :).

3. When you enable IP Source Guard with source IP-MAC filter mode, DHCP snooping Option 82 must be turned on.

   The DHCP host MAC address is not learned until the host is granted a lease, and DHCP snooping uses option-82 data to identify the host port when forwarding packets from the server to the host port. You can check this Cisco doc for further information.