arp anti-attack check user-bind enable
Function
The arp anti-attack check user-bind enable command enables DAI on an interface or in a VLAN. DAI enables the device to check ARP packets based on binding entries.
The undo arp anti-attack check user-bind enable command disables DAI on an interface or in a VLAN.
By default, DAI is disabled on an interface or in a VLAN.
Usage Guidelines
Usage Scenario
To prevent MITM attacks and theft on authorized user information, run the arp anti-attack check user-bind enable command to enable DAI. When a device receives an ARP packet, it compares the source IP address, source MAC address, VLAN ID, and interface number of the ARP packet with binding entries. If the ARP packet matches a binding entry, the device considers the ARP packet valid and allows the packet to pass through. If the ARP packet matches no binding entry, the device considers the ARP packet invalid and discards the packet.
You can enable DAI in the interface view or the VLAN view. When DAI is enabled in the interface view, the device checks all ARP packets received on the interface based on binding entries. When DAI is enabled in the VLAN view, the device checks ARP packets received on interfaces belong to the VLAN based on binding entries.Precautions
The arp anti-attack check user-bind enable command and the aggregate-vlan command cannot be used simultaneously.
Follow-up Procedure
Run the arp anti-attack check user-bind check-item (interface view) or arp anti-attack check user-bind check-item (VLAN view) command to configure check items for ARP packet check based on binding entries.
