P2, P3, and P6 only. Dynamic ARP inspection (DAI) is a security feature that validates ARP packets in a network and prevents ARP spoofing attacks. DAI relies on the DHCP snooping database to verify the IP-to-MAC bindings of hosts on the network. DAI operates on untrusted ports, which are ports that connect to hosts or devices that generate ARP traffic. Trusted ports are ports that connect to other switches or routers that do not generate ARP traffic.
In this scenario, the DHCP snooping database resides on router R1, which means that switch SW2 needs to trust the port P3 that connects to R1. This way, SW2 can receive the DHCP snooping information from R1 and populate its own database. The port P4 that connects to switch SW3 also needs to be trusted, because SW3 does not generate ARP traffic. The ports P2 and P6 that connect to hosts P6 and P7 need to be untrusted, because they generate ARP traffic and need to be validated by DAI. The port P1 that connects to host P5 does not need to be configured as untrusted, because DAI is not enabled on switch SW1.
To understand the concept of DAI and how to configure it, you can refer to the following sections of the source book:
* Section 1.1.2: Describe the concepts of network security
* Section 1.1.2.8: Describe the concepts of DAI
* Section 1.1.2.9: Describe the concepts of DHCP snooping
* Section 1.1.2.10: Describe the concepts of trusted and untrusted ports
* Section 1.1.2.11: Describe the concepts of DAI configuration
References:
* Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0
* Understanding and Configuring Dynamic ARP Inspection
* DHCP Snooping and Dynamic ARP Inspection