Dynamic arp inspection

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

Dynamic ARP Inspection is a Cisco switch security feature that validates ARP messages against trusted IP-to-MAC address bindings and filters invalid messages.

Dynamic ARP Inspection (DAI) protects Cisco switch networks from ARP poisoning by inspecting ARP messages and filtering forged IP-to-MAC mappings. ARP poisoning can redirect LAN traffic to an attacker; Port Security and DHCP Snooping alone do not stop it. section 14.0 section 14.3

DAI permits every ARP message received on a trusted port. It inspects messages received on untrusted ports, checking Sender MAC and Sender IP against the DHCP Snooping binding table; matching entries are forwarded and unmatched entries are discarded. All ports are untrusted by default, so end-host ports normally remain untrusted while router and switch links are trusted. DAI affects ARP messages only. section 14.2.1 section 14.3

Configure and verify DAI with these Cisco IOS operations:

• Enable DAI for one or more VLANs globally: ip arp inspection vlan 1 or ip arp inspection vlan 2-5,7,9,2028. section 14.2
• Trust an infrastructure-facing interface with ip arp inspection trust; leave end-host interfaces at their untrusted default. section 14.2.1
• Verify VLAN state with show ip arp inspection and interface trust and rate limits with show ip arp inspection interfaces. section 14.2 section 14.2.1
• Use an ARP access list with ip arp inspection filter when a permitted static IP-to-MAC mapping is not present in DHCP Snooping bindings. section 14.2.1

Basic Cisco IOS configuration

SW2(config)# ip dhcp snooping SW2(config)# ip dhcp snooping vlan 1 SW2(config)# ip arp inspection vlan 1 SW2(config)# interface g0/1 SW2(config-if)# ip dhcp snooping trust SW2(config-if)# ip arp inspection trust show ip arp inspection reports VLAN 1 as Enabled and Active. End-host interfaces such as Gi0/2 and Gi0/3 remain Untrusted, allowing DAI to inspect their ARP traffic. section 14.2 section 14.2.1

Figure 14.3 Configuring DAI. Note that a port can be untrusted by one feature but trusted by the other, as in SW1’s G0/2 case.

Use the configuration figure to compare DAI trust with DHCP Snooping trust; a port may be trusted by one feature and untrusted by the other. section 14.2

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes

Explains configuration, port trust, binding-table validation, verification commands, and ARP access-list exceptions.

Examples

Uses Cisco IOS commands, VLAN status output, trusted-interface output, DHCP Snooping bindings, and spoofed-ARP denial messages.

What it assumes

Assumes familiarity with ARP and DHCP Snooping while reinforcing their relationship through the DHCP Snooping binding table.

What you can do after

Configure and verify DAI on Cisco IOS switches, then diagnose trust, binding, and filtering problems.

How it connects

Connects ARP, ARP poisoning, DHCP Snooping, DHCP Snooping binding tables, Port Security, and ARP access lists.

liveBookmanning.com

Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

• untrusted portuses · An untrusted port is a switch port whose received ARP messages are inspected by Dynamic ARP Inspection before forwarding or discard.
• DHCP snooping binding tableuses · A DHCP snooping binding table is a switch-maintained table mapping leased IP addresses to client MAC addresses, VLANs, interfaces, and lease information.
• trusted portuses · A trusted port is a switch port on which DHCP messages are permitted without DHCP snooping inspection and whose ARP messages are allowed by Dynamic ARP Inspection.
• arp access control listuses · An ARP access control list is a manually configured set of IP-to-MAC address mappings that Dynamic ARP Inspection can use to validate ARP messages.

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.