How do I configure Dynamic ARP inspection (DAI) using CLI commands on my managed switch?

Enable DHCP snooping globally.

(Netgear Switch) (Config)# ip dhcp snooping
Enable DHCP snooping in a VLAN.

(Netgear Switch) (Config)# ip dhcp snooping vlan 1
Configure the port through which the DHCP server is reached as trusted.

(Netgear Switch) (Config)# interface 1/0/1 (Netgear Switch) (Interface 1/0/1)# ip dhcp snooping trust
View the DHCP Snooping Binding table.
Enable ARP inspection in VLAN 1.

(Netgear Switch) (Config)# ip arp inspection vlan 1

Now all ARP packets received on ports that are members of the VLAN are copied to the CPU for ARP inspection. If there are trusted ports, you can configure them as trusted in the next step. ARP packets received on trusted ports are not copied to the CPU.
Configure port 1/0/1 as trusted.

(Netgear Switch) (Config)# interface 1/0/1 (Netgear Switch) (Interface 1/0/1)# ip arp inspection trust

Now ARP packets from the DHCP client go through because there is a DHCP snooping entry; however ARP packets from the static client are dropped. It can be overcome by static configuration.

For more information, see the following support articles:

This article applies to the following managed switches and their respective firmware:

Last Updated:07/07/2025 | Article ID: 21809