Nothing Special   »   [go: up one dir, main page]
Scribd Logo
Upload

Welcome to Scribd!

  • 30 views

    Dynamic ARP Inspection: DAI in A DHCP Environment

    Uploaded by

    ziad Al-showaiter
    Dynamic ARP inspection is a security feature that validates ARP packets in a network by performing an IP-to-MAC address binding inspection using a trusted DHCP snooping binding database before forwarding packets to their destination. It drops ARP packets with invalid bindings and safeguards against man-in-the-middle attacks by ensuring only valid ARP requests and responses are forwarded. Rate limiting of ARP packets is also supported to prevent denial-of-service attacks on switch CPUs performing the inspection.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Dynamic ARP Inspection: DAI in A DHCP Environment

    Uploaded by

    ziad Al-showaiter
    30 views2 pages
    Dynamic ARP inspection is a security feature that validates ARP packets in a network by performing an IP-to-MAC address binding inspection using a trusted DHCP snooping binding database before forwarding packets to their destination. It drops ARP packets with invalid bindings and safeguards against man-in-the-middle attacks by ensuring only valid ARP requests and responses are forwarded. Rate limiting of ARP packets is also supported to prevent denial-of-service attacks on switch CPUs performing the inspection.

    Original Description:

    Original Title

    Dynamic ARP Inspection

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Dynamic ARP inspection is a security feature that validates ARP packets in a network by performing an IP-to-MAC address binding inspection using a trusted DHCP snooping binding database before forwarding packets to their destination. It drops ARP packets with invalid bindings and safeguards against man-in-the-middle attacks by ensuring only valid ARP requests and responses are forwarded. Rate limiting of ARP packets is also supported to prevent denial-of-service attacks on switch CPUs performing the inspection.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    30 views2 pages

    Dynamic ARP Inspection: DAI in A DHCP Environment

    Uploaded by

    ziad Al-showaiter
    Dynamic ARP inspection is a security feature that validates ARP packets in a network by performing an IP-to-MAC address binding inspection using a trusted DHCP snooping binding database before forwarding packets to their destination. It drops ARP packets with invalid bindings and safeguards against man-in-the-middle attacks by ensuring only valid ARP requests and responses are forwarded. Rate limiting of ARP packets is also supported to prevent denial-of-service attacks on switch CPUs performing the inspection.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 2

    Dynamic ARP Inspection

    Address Resolution Protocol (ARP) provides IP-to-MAC resolution, ARP operates at Layer 2 (the data-link
    layer) of the OSI model. ARP provides the translation mapping the IP address to the MAC address of the
    destination host using a lookup table (also known as the ARP cache).

    Dynamic ARP inspection is a security feature that validates ARP packets in a network. Dynamic ARP
    inspection determines the validity of packets by performing an IP-to-MAC address binding inspection
    stored in a trusted database, (the DHCP snooping binding database) before forwarding the packet to the
    appropriate destination.

    inspection will drop all ARP packets with invalid IP-to-MAC address bindings that fail the inspection. The
    DHCP snooping binding database is built when the DHCP snooping feature is enabled on the VLANs and
    on the switch.

    The dynamic ARP Inspection (DAI) feature safeguards the network from many of the commonly known
    man-in-the-middle (MITM) type attacks. Dynamic ARP Inspection ensures that only valid ARP requests
    and responses are forwarded.

    DAI in a DHCP Environment


    As mentioned earlier, DAI relies on the entries in the DHCP snooping binding database to verify IP-to-
    MAC address bindings. Configure each secure interface as trusted using the ip arp inspection
    trust interface configuration command. The trusted interfaces bypass the ARP inspection validation
    checks, and all other packets are subject to inspection when they arrive on untrusted interfaces .

    Example 4-11. DAI in a DHCP Environment Configuration Example

    Switch(config)# interface GigabitEthernet1/0/1


    Switch(config-if)# ip arp inspection trust
    Switch(config)# ip arp inspection vlan 5-10
    DAI in a Non-DHCP Environment
    In non-DHCP environments, because there is no DHCP snooping binding database, the DAI can validate
    ARP packets against a user-defined ARP ACL to map hosts with a statically configured IP address to their
    MAC address.

    Example 4-12. DAI in a Non-DHCP Environment Configuration Example

    Switch(config)# arp access-list arpacl


    Switch(config-arp-acl)# permit ip host 10.1.1.11 mac host 0011.0011.0011
    Switch(config-arp-acl)# exit
    Switch(config)# ip arp inspection filter arpacl vlan 5
    Switch(config)# interface GigabitEthernet1/0/2
    Switch(config-if)# no ip arp inspection trust

    Rate Limiting Incoming ARP Packets

    Because the switch CPU performs the DAI, there is a potential for an ARP flooding denial-of-service
    (DoS) attack resulting in performance degradation. To prevent this, ARP packets can be rate limited
    using the ip arp inspection limit command from the interface configuration mode to limit the rate of
    incoming ARP requests and responses. By default, 15 pps (packets per second) is allowed on untrusted
    interfaces; however, there is no limit on trusted interfaces. The burst interval is 1 second.

    When the rate of incoming ARP packets exceeds the configured thresholds, the port is placed in the
    error-disabled state. The port will remain in this state until the user intervenes or the errdisable
    recovery cause arp-inspection interval [seconds] command is enabled, so that ports can automatically
    recover from this state after a specified timeout period.

    ARP Validation Checks


    Specific additional checks can be performed on incoming ARP packets to validate the destination MAC
    address, the sender IP address in ARP requests, the target IP address in ARP responses, or the source
    MAC address. Use the ip arp inspection validate {[src-mac] [dst-mac] [ip]} command

    You might also like