Interface Trust States and Network Security
DAI associates a trust state with each interface on the device. Packets that arrive on trusted interfaces bypass
all DAI validation checks, and packets that arrive on untrusted interfaces go through the DAI validation
process.
In a typical network configuration, the guidelines for configuring the trust state of interfaces are as follows:
Untrusted
Interfaces that are connected to hosts
Trusted
Interfaces that are connected to devices
With this configuration, all ARP packets that enter the network from a device bypass the security check. No
other validation is needed at any other place in the VLAN or in the network.
Use the trust state configuration carefully. Configuring interfaces as untrusted when they should be trusted
can result in a loss of connectivity.
Caution
Figure 16: ARP Packet Validation on a VLAN Enabled for DAI
The following figure assumes that both device A and device B are running DAI on the VLAN that includes
host 1 and host 2. If host 1 and host 2 acquire their IP addresses from the DHCP server connected to device A,
only device A binds the IP-to-MAC address of host 1. If the interface between device A and device B is
untrusted, the ARP packets from host 1 are dropped by device B and connectivity between host 1 and host 2
is lost.
If you configure interfaces as trusted when they should be untrusted, you may open a security hole in a network.
If device A is not running DAI, host 1 can easily poison the ARP cache of device B (and host 2, if you
configured the link between the devices as trusted). This condition can occur even though device B is running
DAI.
DAI ensures that hosts (on untrusted interfaces) connected to a device that runs DAI do not poison the ARP
caches of other hosts in the network; however, DAI does not prevent hosts in other portions of the network
from poisoning the caches of the hosts that are connected to a device that runs DAI.
If some devices in a VLAN run DAI and other devices do not, the guidelines for configuring the trust state
of interfaces on a device that runs DAI become the following:
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
391
Configuring Dynamic ARP Inspection
Interface Trust States and Network Security
