All language subtitles for Free-CCNA-Dynamic-ARP-Inspection-Day-51-CCNA-200-301-Complete-Course_en

This is a free, complete course for the CCNA.

If you like these videos, please subscribe\n

Also, please like and leave a comment, and\n

In this video we’ll cover Dynamic ARP Inspection.

Dynamic ARP Inspection, also called DAI, is\n

must be able to configure Layer 2 security\n

We covered DHCP snooping and port security\n

Dynamic ARP inspection is a security feature\n

a similar manner to how DHCP snooping inspects\nDHCP messages.

So, this video will follow a similar structure\n

Here’s what we’ll cover in this video.

First, what is dynamic ARP inspection?

I’ll give a brief overview, and then introduce\nhow it works.

I’ll show you what attacks it can be used\n

we look into more details of its operations.

Watch until the end of the video for a bonus\n

ExSim for CCNA, my recommended practice exams\nfor the CCNA.

Before dynamic ARP inspection, let’s quickly\nreview ARP itself.

ARP is used to learn the MAC address of another\n

For example, a PC will use ARP to learn the\n

It will also use ARP to learn the MAC address\n

Typically it’s a two message exchange, consisting\n

For example, PC1 wants to send a DNS query\n

It thinks, 8.8.8.8 is outside of my local\n

However, PC1 doesn’t know the MAC address\n

So, it will broadcast this ARP request message,\n

Every device in the LAN will receive the message,\n

broadcast MAC address of all Fs.

Let’s look at that ARP request in wireshark.

The ARP message is encapsulated in an Ethernet\n

So, in the previous slide when I wrote ‘source\n

message, I’m actually referring to these\n

Specifically the sender IP address, which\n

address, which is the destination IP address.

ARP messages are only broadcast within the\n

networks, so there’s no need to encapsulate\n

Keep these fields in mind, sender MAC and\n

they can play a role in the dynamic ARP inspection\nprocess.

Because its IP address was in the ARP message’s\n

an ARP reply to PC1 so that PC1 can learn\n

Note that R1 also added an entry for PC1 in\n

ARP request from PC1, so R1 doesn’t need\n

Here’s that ARP reply in Wireshark.

The sender IP and MAC fields are R1’s addresses,\n

Pause the video if you want to check out the\nmessage.

So, PC1 is now able to insert R1’s MAC address\n

then send the message to R1 which will forward\n

So, that’s the basic ARP process.

But there is also something called gratuitous\n

A gratuitous ARP message is an ARP reply that\n

It is sent to the broadcast MAC address, all\nFs.

Note that standard ARP replies are not broadcast.

They are unicast messages sent to the device\n

Gratuitous ARP allows other devices on the\n

the device that sent the gratuitous ARP, and\n

This depends on the device maker, but some\n

messages when an interface is enabled, IP\n

So, for example if PC2’s network interface\n

reply, and it is flooded in the local network.

Now the other devices will add an ARP entry\n

also add entries for PC2 in their MAC address\ntables.

We’ll come back to the concept of gratuitous\n

Okay, let’s move on to Dynamic ARP Inspection.

DAI is a feature of switches that is used\n

All other messages will be unaffected.

Just like DHCP snooping, all ports are untrusted\nby default.

Typically, all ports connected to other network\n

should be configured as trusted, while interfaces\n

So, in this network that means we should configure\n

Now, SW2’s interface connected to SW1 could\n

downlink leading toward the end hosts.

In Cisco’s documentation they recommend\n

routers, etc. are configured as trusted, so\n

Here’s how DAI works, and you’ll see it’s\n

Because it arrives on an untrusted port, SW1\n

It determines the message is OK, so it forwards\nit to SW2.

In this case SW2 doesn’t inspect it, because\n

so it forwards it to R1, which sends the reply.

This message isn’t inspected by SW2 or SW1,\n

This time PC2 sends an ARP message, but SW1\n

because it violates the rules of DAI.

I’ll explain exactly how DAI determines\n

let me show you an ARP-based attack.

So, this is the ARP poisoning attack, which\n

Similar to DHCP poisoning, ARP poisoning involves\n

so traffic is sent to the attacker.

To do this, the attacker can send gratuitous\n

Another option is to send replies to the targets’\n

use gratuitous ARP for this demonstration.

Other devices will receive the gratuitous\n

to send traffic to the attacker instead of\n

For example, the attacker PC2 sends a GARP\n

It is flooded through the network, and all\ndevices receive it.

So, they update their ARP tables to map PC2’s\n

By the way, R1 doesn’t update its ARP table,\n

Now, if PC1 wants to send this packet to an\n

PC2 can save a copy of the message for future\n

It’s possible that PC2 could also manipulate\n

So, this is how ARP can be used to perform\n

DHCP poisoning attack shown in the previous\nvideo.

Now let’s see how DAI can protect against\nthis kind of attack.

First, here’s a summary of how DAI works.

DAI inspects the sender MAC and sender IP\n

ports and checks if there is a matching entry\n

So, I showed you in the previous video that\n

as you can see the MAC addresses and IP addresses\n

So, DAI checks ARP messages and if there is\n

the ARP message is forwarded normally.

However, if there isn’t a matching entry\n

Note that this check only occurs on untrusted\n

However, just like in DHCP snooping all ports\n

specify which ports are trusted.

So, DAI operations are usually reliant on\n

ARP ACLs can be manually configured to map\n

This can be useful for hosts that don’t\nuse DHCP.

If they don’t use DHCP, they won’t have\n

will just drop all ARP messages they try to\nsend.

You can configure ARP ACLs for these specific\nhosts.

Or all hosts if you want, but that’s a lot\nof manual work.

I’ll show you how to configure ARP ACLs\nlater.

In addition to the sender MAC and sender IP\n

in-depth checks, but these are optional.

I’ll briefly introduce them later.

And like DHCP snooping, DAI also supports\n

I didn’t mention this in the last video,\n

So, even if the attacker’s messages are\n

CPU by sending a ton of ARP messages.

If the attacker tries to do that, rate limiting\n

Now let’s move on to DAI configuration.

First up, the basic commands to enable it\n

First, use IP ARP INSPECTION VLAN, followed\n

In this network I’m using VLAN 1 only.

However, if there are multiple VLANs, you\n

If you don’t, only ARP messages in the specified\n

Then I configured SW2’s G0/0 and G0/1 interfaces\n

And that’s it, those are the basic commands\n

Then I did the same configurations on SW1,\n

Now, you might have noticed a difference between\n

DHCP requires two commands to enable it, IP\n

So, enable it globally and then enable it\nper VLAN.

DAI is different, you only have to enable\n

Honestly I’m not sure the reason for this\n

Okay let’s check out one of the DAI show\n

First, you can see the trust state of each\ninterface.

On SW1 only G0/0 is trusted, as I configured.

This column shows us the DAI rate limiting\nsettings.

There are a few differences between DHCP snooping\n

DAI rate limiting is enabled on untrusted\n

per second, but it is disabled on trusted\nports by default.

In the case of DHCP snooping, rate limiting\n

And this column shows us one more difference.

DHCP snooping rate limiting is configured\nlike this.

However DAI has a feature called the burst\n

limiting like X packets per Y seconds.

So, the interval being measured doesn’t\n

flexibility with how you can control the rate\n

Okay, since I just brought up DAI rate limiting\n

Let’s configure DAI rate limiting on SW1.

First, on G0/1 and 2 I used IP ARP INSPECTION\n

then BURST INTERVAL 2, that means 2 seconds.

So, I changed the rate from 15 packets per\n

Note that the burst interval is optional.

If you don’t specify it, the default is\n1 second.

To demonstrate, on G0/3 I configured IP ARP\n

And here you can see the results.

For G0/1 and 2 it’s 25 packets per 2 seconds,\n

So, that’s how DAI rate limiting is configured.

If ARP messages are received faster than the\n

Let me emphasize that, rate limiting limits\n

an interface, not sent by an interface.

Anyway, interfaces disabled by ARP inspection\n

NO SHUTDOWN on the interface, or with err-disable\nrecovery.

The command is ERRDISABLE RECOVERY CAUSE ARP-INSPECTION.

I configured err-disable recovery on SW1,\n

Okay, that’s all for DAI rate limiting.

Now let me introduce those additional checks\nI mentioned before.

By default, DAI checks the sender MAC and\n

entry in the DHCP snooping binding table or\nnot.

However, additional checks can be performed\n

The three options are destination MAC, IP,\nand source MAC.

I think Cisco’s explanations are quite straightforward\n

Destination MAC validates ARP responses by\n

Ethernet header against the target MAC address\n

If they are different, the frame is dropped.

IP validation looks for invalid or unexpected\n

ARP messages, such as 0.0.0.0, 255.255.255.255,\n

These IP addresses shouldn’t belong to a\n

The sender IP address is checked in both ARP\n

IP address is checked only in ARP replies.

Finally, source MAC validation checks the\n

it to the sender MAC in the ARP message.

If they don’t match, the message is considered\n

To clarify those, here is that ARP reply message\n

These validation checks look at the source\n

header, and also at these fields in the ARP\nmessage itself.

In this case, the source and destination in\n

MAC addresses in the ARP message, so the message\n

The sender and target IP addresses in the\n

Note that these checks are done in addition\n

the sender MAC and IP addresses and compares\n

So, if these checks are configured an ARP\n

There’s an important point to mention about\n

I configured, in order, IP ARP INSPECTION\n

checked with SHOW RUN | INCLUDE VALIDATE.

So, what do you think was displayed?

Only VALIDATE SRC-MAC was displayed.

First I configured VALIDATE DST-MAC, but when\n

Then when I configured VALIDATE SRC-MAC, it\noverwrote IP.

So, if you want to enable all three checks,\n

IP ARP INSPECTION VALIDATE IP SRC-MAC DST-MAC.

I checked again, and now you can see all three.

To summarize, you must enter all of the validation\n

You can specify one, two, or all three, and\n

Okay, those are the optional validation checks\n

Now there is one more topic I want to cover,\nARP ACLs.

Now, I’m pretty sure the topic of ARP ACLs\n

So, I will just give a quick example of how\n

I won’t go into the details here.

Here is SW2’s DHCP snooping binding table.

SRV1 has a static IP address, 192.168.1.100,\n

So, what will happen when SRV1 tries to send\nan ARP request?

It will be dropped, with an error message\nlike this.

It says 1 invalid ARP request on G0/2 in VLAN1.

That’s because SRV1 doesn’t have an entry\n

So, to fix this let’s configure an ARP ACL\nto permit SRV1.

ARP ACCESS-LIST, followed by a name, to create\nthe ARP ACL.

Then I configured PERMIT IP HOST 192.168.1.100\n

But, creating the ARP ACL alone doesn’t\n

The command is IP ARP INSPECTION FILTER, the\n

Okay, we created the ARP ACL and then applied\nit.

This time when SRV1 tries to send an ARP request,\n

in the DHCP snooping binding table.

That’s because of the ARP ACL we configured.

Here’s one last show command before we finish,\n

It gives a summary of the DAI configuration\n

have been forwarded and dropped.

Let me just point out a few fields, you don’t\n

First, notice that source MAC, destination\n

I enabled them on SW1 before, but I enabled\nthem on SW2 also.

Here we can see that DAI is configured and\n

Now, this is a detail beyond the scope of\n

If static ACL is set to yes, the implicit\n

Like regular IP ACLs, ARP ACLs also have an\nimplicit deny.

But if you don’t enable the static setting,\n

I didn’t configure it as a static ACL, so\n

But what will happen if the implicit deny\ntakes effect?

It will cause all ARP messages not permitted\n

So, in effect this means that only the ARP\nACL will be checked.

The DHCP snooping table will not be checked.

Usually we leave this setting as No, and as\n

beyond the scope of the CCNA, so let’s keep\ngoing.

Here you can see some statistics about how\n

Notice 4 messages have been dropped, and all\n4 are DHCP drops.

That means messages dropped because there\n

That’s because I tried to ping from SRV1\n

However, here you can see 1 ACL permit.

This is when SW2 permitted SRV1’s ARP message\n

SRV1’s ARP request message was permitted\nand counted here.

Here is a summary of the new commands we looked\n

As always, go back in the video to review\n

Also make sure to practice these commands\n

Hands-on practice is an essential part of\nstudying for the CCNA.

Before moving on to the quiz, here’s a quick\n

I introduced what Dynamic ARP Inspection is.

It’s a switch security feature similar to\n

then decides to forward or drop the message.

I introduced how it works and what attacks\n

can be used to perform a man-in-the-middle\nattack.

I also showed you how to configure DAI, while\n

Honestly, in this video I probably gave you\n

know for the CCNA, but I’d rather give you\n

Make sure to watch until the end of the quiz\n

ExSim for CCNA, my recommended practice exams\nfor the CCNA.

Okay, let’s go to quiz question 1.

You issue the IP ARP INSPECTION VLAN 1 command\non SW1.

Which of the following statements is true\n

Pause the video now to select the correct\nanswer.

The answer is A, all interfaces in VLAN 1\nare untrusted.

Just like in DHCP snooping, when DAI is first\n

So, to trust specific ports you’ll have\n

Okay, let’s go to question 2.

The following commands are configured on SW1.

Which of the following statements is true\n

Pause the video now to select the best answer.

Okay, the answer is C, DAI validation is only\n

When configuring these optional DAI validation\n

configure them all in a single command.

Otherwise, only the last command entered will\ntake effect.

Okay, let’s go to question 3.

Which of the following are true about DAI\nrate limiting?

Okay, pause the video now to select the two\ncorrect answers.

Okay, the answers are B, it is enabled on\n

at a rate of 15 packets per second by default.

Unlike DHCP snooping rate limiting, for DAI\n

per second on all untrusted ports by default.

Another difference between DHCP snooping and\n

burst interval, so the rate limit can be calculated\n

DHCP snooping only allows you to configure\n

Okay, let’s go to question 4.

DAI inspects the sender IP and MAC addresses\n

Which of the following does it check the sender\n

Pause the video now to select the two correct\nanswers.

Okay, the answers are B, DHCP snooping binding\n

When DHCP snooping is enabled, the DHCP snooping\n

lease IP addresses from DHCP servers.

So, DAI uses that table to check ARP messages.

However, for hosts that don’t use DHCP,\n

Which of the following commands limit ARP\n

Pause the video now to select the correct\nanswers.

Okay, the answers are A, IP ARP INSPECTION\n

Both of them will limit ARP messages received\n

However, 45 packets over three seconds allows\n

30 packets in 1 second, 10 packets the next\n

However the 15 packets over 1 second setting\n

the rate never goes over 15.

Okay, that’s all for the quiz.

Now let’s take a look at a bonus question\n