>> arp-inspection
>
> DAI is a self-defeating misfeature which can result in a self-DoS of the
> switch. Don't enable it!
Interesting, can you elaborate?
I had my fair share of issues with DAI, but so I did with DHCP snooping,
PPPoE IA and every other security feature that uses a software process
(and therefor needs to be punted).
Lack of proper layer 2 behavior (respect: STP, allowed vlans, private vlans,
uni/uni relations, split-horizon) in the software forwarding process and
insufficient control-plane protection (punting to the CPU is rate-limited,
but when traffic is QinQ'ed, rate-limiter is bypassed and CPU can be
overwhelmed) are issues that keep popping up (not once, but once per
feature - so if you insist on the fix in PPPoE IA code, DAI and DHCP
snooping are still lacking the same fix).
Is that what you mean?
Regards,
Lukas
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
