- [Instructor] Cisco
has an ARP spoofing protection mechanism
known as Dynamic ARP Inspection or DAI.
In a nutshell, a switch with DAI enabled on a port
will consult the DHCP snooping binding table
and insure that any ARP sent from an un-trusted port
have a valid entry for the IP and MAC combo on that port.
As mentioned before,
DAI can use the DHCP snooping binding table.
So DHCP snooping should be enabled on the switch.
Cisco switches will allow an administrator to enable DAI
without DHCP snooping running.
But it will discard all ARP frames on those ports
which will effectively make all connectivity fail
on that port.
Having said that, DAI can also use ARP ACLs
in place of DHCP snooping binding.
ARP ACLs are statically configured lists
of IP-to-MAC addresses.
Since these must be manually maintained
they are not recommended.
With DAI correctly implemented
a host can't perform a man in the middle attack
by spoofing a gateway's ARPs.
I've seen some DOS attacks where a malicious host
will apply to every ARP request
which can reek havoc on a LAN.
Like DHCP snooping, DAI is configured globally
on a VLAN.
Trusted ports should also be specified.
Generally these will be anything other than user ports.
Make note of the diagram here.
VLAN ten has already been configured
and added to the correct ports.
DHCP snooping was configured in the previous chapter
and is still in place.
I'll start by setting my trusted ports.
Config t
interface
range
fa zero forward slash one
and fa zero forward slash 24.
IP ARP
inspection
trust.
Again these trust imports don't participate in DAI.
Now I'll enable it globally.
IP ARP inspection
VLAN ten.
It really configures quite quickly.
Verification is done with.
Show IP ARP inspection
which shows setting and counters.
I can also view the DHCP snooping binding table with
show IP DHCP
snooping binding
which will verify MAC and IP bindings.
DAI also has rate limiting of ARPS
enabled by defaults since too many ARP requests
can overrun the switch CPU.
DAI rate limiting also allows for a burst period
to be defined if the administrator chooses.
Each interface can adjust the rate limit individually with
fig t interface fa zero forward slash 22.
IP ARP
inspection limit
rate ten.
The Cisco recommend in default rate limit is 15.
The configure rate limits can be viewed with
do show IP ARP inspection interfaces.
There are some additional options
that ratchet up the security when using DAI.
Destination MAC, source MAC, and IP address validation.
This will validate these fields within ARP messages.
These can be enabled individually or as groups
with the global IP ARP inspection validation
destination source IP commands.
DAI is another great tool in the fight against misuse
on your networks.