CCNA Notes

200-301 Exam Prep

Progress0/67

0% complete

Practice TestsNew
1Networking Devices2Interfaces And Cables3OSI Model and TCP/IP Suite4Intro to the CLI5Ethernet LAN Switching - Part 16Ethernet LAN Switching - Part 27IPv4 Addressing - Part 18IPv4 Addressing - Part 29Switch Interfaces10The IPv4 Header11Routing Fundamentals - Part 111Static Routing - Part 212Life of a Packet13Subnetting - Part 114Subnetting - Part 215Subnetting (VLSM) - Part 316VLANs - Part 117VLANs - Part 218VLANs - Part 319DTP / VTP20Spanning Tree Protocol - Part 121Spanning Tree Protocol - Part 222Rapid Spanning Tree Protocol23Etherchannel24Dynamic Routing25RIP / EIGRP26OSPF - Part 127OSPF - Part 228OSPF - Part 329First Hop Redundancy Protocol30TCP and UDP31IPv6 - Part 132IPv6 - Part 233IPv6 - Part 334Standard Access Control List35Extended Access Control List36CDP and LLDP37NTP - Network Time Protocol38DNS - Domain Name System39DHCP - Dynamic Host Configuration Protocol40SNMP - Simple Network Management Protocol41SYSLOG42SSH - Secure Shell43FTP and TFTP44NAT (Static) - Part 145NAT (Dynamic) - Part 246QoS (Voice VLAN) - Part 147QoS (Quality of Service) - Part 248Security Fundamentals49Port Security50DHCP Snooping51Dynamic ARP Inspection52LAN Architectures53WAN Architectures54Virtualization and Cloud - Part 154Virtualization (Containers) - Part 254Virtualization (VRF) - Part 355Wireless Fundamentals56Wireless Architectures57Wireless Security58Wireless Configuration59Introduction to Network Automation60JSON, XML, and YAML61REST APIs62Software Defined Networking63Ansible, Puppet, and Chef67CCNA Complete Cheatsheet
/Dynamic ARP Inspection
Topic 513 min read

Dynamic ARP Inspection

/
Tip: Select text to highlight or pin your reading position

51. DYNAMIC ARP INSPECTION

WHAT IS DYNAMIC ARP INSPECTION (DAI) ?

ARP REVIEW

  • ARP is used to learn the MAC ADDRESS of another DEVICE with a known IP ADDRESS
    • For example, a PC will use ARP to learn the MAC ADDRESS of its DEFAULT GATEWAY to communicate with external NETWORKS
  • Typically, it is a TWO MESSAGE EXCHANGE : ARP REQUEST and ARP REPLY

GRATUITOUS ARP

  • A GRATUITOUS ARP MESSAGE is an ARP REPLY that is sent without receiving an ARP REQUEST
  • It is SENT to the BROADCAST MAC ADDRESS
  • It allows other DEVICES to learn the MAC ADDRESS of the sending DEVICE without having to send ARP REQUESTS.
  • Some DEVICES automatically send GARP MESSAGES when an INTERFACE is enabled, IP ADDRESS is changed, MAC address is changed, etc.

DYNAMIC ARP INSPECTION

  • DAI is a SECURITY FEATURE of SWITCHES that is used to filter ARP MESSAGES received on UNTRUSTED PORTS
  • DAI only filters ARP MESSAGES. Non-ARP MESSAGES are NOT affected
  • All PORTS are UNTRUSTED, by DEFAULT
    • Typically, all PORTS connected to other NETWORK DEVICES (SWITCHES, ROUTERS) should be configured as TRUSTED, while INTERFACES connected to END HOSTS should remain UNTRUSTED

imageClick to enlarge

imageClick to enlarge

imageClick to enlarge

ARP POISONING (MAN IN THE MIDDLE)

  • Similar to DHCP POISONING, ARP POISONING involved an ATTACKER manipulating TARGET’S ARP TABLES so TRAFFIC is sent to the ATTACKER
  • To do this, the ATTACKER can send GRATUITOUS ARP MESSAGES using another DEVICE’S IP ADDRESS
  • Other DEVICES in the NETWORK will receive the GARP and update their ARP TABLES, causing them to send TRAFFIC to the ATTACKER instead of the legitimate DESTINATION

imageClick to enlarge

DYNAMIC ARP INSPECTION OPERATIONS

  • DAI inspects the SENDER MAC and SENDER IP fields of ARP MESSAGES received on UNTRUSTED PORTS and checks that there is a matching entry in the DHCP SNOOPING BINDING TABLE
    • If there is a MATCH, the ARP MESSAGE is FORWARDED
    • If there is NO MATCH, the ARP MESSAGE is DISCARDED

imageClick to enlarge

  • DAI doesn’t inspect messages received on TRUSTED PORTS. They are FORWARDED as normal.

  • ARP ACLs can be manually configured to map IP ADDRESSES / MAC ADDRESSES for DAI to check

    • Useful for HOSTS that don’t use DHCP

  • DAI can be configured to perform more in-depth checks also - but these are optional

  • Like DHCP SNOOPING, DAI also supports RATE-LIMITING to prevent ATTACKERS from overwhelming the SWITCH with ARP MESSAGES

    • DHCP SNOOPING and DAI both require work from the SWITCH’S CPU
    • Even if the ATTACKER’S messages are BLOCKED, they can OVERLOAD the SWITCH CPU with ARP MESSAGES

DYNAMIC ARP INSPECTION CONFIGURATION

imageClick to enlarge

imageClick to enlarge

Command : show ip arp inspection interfaces

imageClick to enlarge

DAI RATE LIMITING

imageClick to enlarge

DAI OPTIONAL CHECKS

imageClick to enlarge

imageClick to enlarge

imageClick to enlarge

ARP ACLs (Beyond Scope of CCNA)

CREATE AN ARP ACL FOR SRV1

imageClick to enlarge

AFTER APPLYING IT TO SWITCH 2, SRV1 is able to send ARP REQUEST to R1

imageClick to enlarge

Command: show ip arp inspection

Shows a summary of the DAI configuration and statistics

imageClick to enlarge

COMMAND REVIEW

imageClick to enlarge

PreviousDHCP Snooping
NextLAN Architectures