Dynamic ARP Inspection Implementation Guidelines

Enable DHCP snooping globally

Enable DHCP snooping on selected VLANs

Enable DAI on selected VLANs

Configure trusted interfaces for DHCP snooping and ARP inspection

It is generally advisable to configure all access switch ports as untrusted and to configure all uplink ports that are connected to other switches as trusted