Dynamic ARP Inspection (DAI) relies on the DHCP-Snooping binding table to validate ARP packets. Aruba AOS-CX requires DHCP-Snooping to be enabled on every VLAN that is protected by DAI; otherwise no bindings exist and all ARP packets will be dropped or bypassed unverified. Because VLAN 4 lacks DHCP-Snooping, the current configuration cannot protect against ARP poisoning.

A. ARP proxy is unrelated to DAI and provides no protection against spoofed ARP packets.

B. Uplink (LAG 1) should remain trusted so that legitimate ARP traffic from upstream switches is not inspected; making it untrusted is unnecessary.

D. Interfaces are untrusted by default; edge ports do not need an explicit “untrusted” command, so their absence is not an issue.

1. Aruba AOS-CX 10.09 Security Guide

“Dynamic ARP Inspection”

p. 272-275: “DAI requires DHCP-Snooping to be enabled on the same VLAN… Without Snooping bindings

ARP validation cannot occur.”

2. Aruba AOS-CX 10.09 Security Guide

p. 273: “All interfaces are untrusted by default; use ‘arp inspection trust’ only on uplinks or to DHCP servers.”

3. Aruba AOS-CX 10.09 Command-Line Guide

“Configuring DHCP-Snooping”

p. 163: command syntax for enabling snooping per-VLAN

prerequisite for DAI.