- [Narrator 1] ARP provides IP communication
within a layer two broadcast domain
by mapping an IP address to Mac address.
For example, host B wants to send information to host A
but does not have the Mac address
of host A in its address, resolution protocol cache.
Host B generates a broadcast message
for all hosts within the broadcast domain
to obtain the Mac address associated
with the IP address of host A.
All hosts within the broadcast domain
receive the ARP request and host A responds
with its Mac address.
ARP spoofing attacks and our cache poisoning can occur
because ARP allows a gratuitous reply from a host
even if an ARP request was not received.
After the attack all traffic from the device
under attack flows through the attacker's computer
and then to the router switch or host.
An ARP spoofing attack can target host switches
and routers connected to your layer to network
by poisoning the ARP caches of systems connected
to the subnet and by intercepting traffic intended
for other hosts on the subnet.
The diagram here shows an example of ARP cache poisoning.
Host A, B and C are connected to the switch on interfaces
A, B and C, all of which are on the same subnet.
Their IP and Mac addresses are shown in parenthesis.
For example, host A uses IP address IA and Mac address MA.
When host A needs to communicate to host B
at the IP layer it broadcasts an ARP request
for the Mac address associated with IP address IB.
When the switch and host B receive the ARP request
they populate their ARP caches with an ARP binding
for a host with the IP address IA and a Mac address MA.
For example, IP address IA is bound
to Mac address MA.
When host B responds the switch
and host A populate their ARP caches with the binding
for host with the IP address IB
and the Mac address MB, host C can poison the
ARP caches of the switch for host A and host B
by broadcasting forged our responses with bindings
for a host, with an IP address of IA or IB
and a Mac address of MC.
Host with poison ARP caches used the Mac addresses MC
as the destination Mac address
for traffic intended for IA or IB.
This means that host C intercepts that traffic
because host C knows the true Mac addresses associated
with IA and IB.
It can forward the intercepted traffic
to those hosts by using the correct Mac address
and the destination.
Host C has inserted itself
into the traffic stream from host A to host B
which is the topology
of the classic man in the middle attack.
DAI is a security feature that validates ARP packets
in a network, DAI intercepts logs and discards ARP packets
with invalid IP to Mac address bindings.
This capability protects the network
from some man in the middle attacks.
DAI determines the validity of an ARP packet based
on valid IP to Mac address bindings stored
in a trusted database.
The DHCP snooping binding database
as described in the previous lesson
this database is built by DHCP snooping
if DHCP snooping is enabled on the VLANs and on the switch.
If the ARP packet is received on a trusted interface
the switch forwards the packet without any checks.
On un-trusted interfaces,
the switch forwards the packet only if it is valid.
You can configure DAI to drop ARP packets
when the IP addresses in the packets are invalid
or when the Mac addresses in the body
of the ARP package do not match the addresses specified
in the ethernet header.
This example provides the configuration details
necessary to implement DAI
to mitigate the effects of ARP spoofing attacks.
- [Narrator 2] In this demo,
we are enabling dynamic ARP inspection
on VLAN 10, the first command IP ARP inspection
VLAN 10 enables it on that VLAN interface.
From there, we can do the show IP ARP inspection, VLAN 10.
This will show us all of the information
and verify our configuration.
Next we'll move on to enable it on an interface.
Here we enable it on gigabit 1/1/1
and then we run the IP ARP inspection trust
to add it to the trusted DAI interface list.
From there, we can simply run show IP ARP
inspection interfaces to see all
the interfaces with it enabled.