- COURSES
- SPECIALS
- BLOG
- MEMBERS
- SHOP
- BOOKSHELF
- ABOUT
- ENROLL HERE
Table of Contents
Dynamic ARP Inspection (DAI) is a Layer 2 security mechanism that protects the network against ARP spoofing and ARP poisoning attacks. ARP attacks can be done as a Man-in-the-Middle Attack by an attacker. In this type of attack, by capturing the traffic between two hosts, attacker poisons the ARP Cache and sends his/her own MAC address as requested ip address. To prevent from such a maniplation, we should validate IP-MAC matchings. Dynamic ARP Inspection does this by inspecting ARP packets and validating the IP-to-MAC address mappings before forwarding them. After Dynamic ARP Inspection configuration, if an invalid ARP packet is detected, the switch drops it. In this lesson, we will configure Dynamic ARP Inspection.
We will use the below topology for our configuration. As you can see, in this topology, there are two switches connected to each other, and two PCs are connected to each switch.
Dynamic ARP Inspection (DAI) uses DHCP Snooping binding database that is created by DHCP Snooping by listening DHCP Messages between the nodes. According to the DHCP Snooping binding database, DAI decides what to do. If there is a record in the database about sender’s IP and MAC address then it accepts the ARP Packet. If there is no record in the database, ARP packet is rejected. Instead of using DHCP Snooping, Static IP-MAC mappings can be also used for this validation process.
DAI works together with DHCP Snooping and validates every ARP packet before forwarding it. Dynamic ARP Inspection (DAI) uses Trust states for interfaces. There are two trust states for interfaces, these are given below:
If an interface set as Trusted, DAI does not work for this interface. But if it is an Untrusted, DAI precedures work and the MAC-IP matchings are checked. In other words, if we set an interface as trusted, we do not do a validation on these interfaces.
In a network all the interfaces connected to the hosts are configured as Untrusted while the interfaces connected to the switches are configured as Trusted. By doing this, ARP Packets are checked if it is coming from a host device. Because, generally such an attacks can come from a host interface.
By the way, Dynamic ARP Inspection is done through VLANs. One or one more VLANs can be used for this configuration.
As you can see above, if DAI is enabled, IP-MAC Binding Table is cheched and then if the incoming MAC address is in binding table, then this ARP Packet is accepted. If not, then the packet is discarded. Above, Host B and Host C is sending ARP packets including different MAC addresses maliciously. They are connected to the interfaces which were configured as untrusted. So, IP-MAC validation will be done on these interfaces. So, this malicious behaviour will be detected by Dynamic ARP Inspection Mechanism.
To configure Dynamic ARP Inspection on Cisco switches, we will use the below simple switch topology. As you can see below,m there are two switch connected to eachother and there are two PCs are connected to each switch.
Dynamic ARP Inspection (DAI) can be enabled for specific VLANs. Here, we will configure DAI only for VLAN 2. The interfaces connected to the hosts in VLAN 2 will be untrusted. Therefore, ARP packets received on these interfaces will be inspected and their IP-to-MAC address mappings will be validated. The remaining interfaces will be configured as trusted interfaces.
Now, let’s start configuring Dynamic ARP Inspection.
Enabling Dynamic ARP Inspection
To enable Dynamic ARP Inspection for VLAN 2, we will use the “ip arp inspection vlan <vlan-id>” command in the global configuration mode of the Cisco switch.
Switch A# configure terminal
Switch A(config)# ip arp inspection vlan 2
Setting Trusted interfaces
To configure an interface as trusted, we will use the “ip arp inspection trust” command under the interface configuration mode. On Switch A, we will configure FastEthernet 0/1 and FastEthernet 0/3 as trusted interfaces. The remaining interfaces will remain untrusted by default.
Switch A(config)# interface fastethernet 0/1
Switch A(config-if)# ip arp inspection trust
Switch A(config)# interface fastethernet 0/3
Switch A(config-if)# ip arp inspection trust
Here, we configured these two interfaces as trusted. The other interface, FastEthernet 0/2, remains untrusted because all switch interfaces are untrusted by default.
Switch B Configuration
Now, let’s perform the same configuration on the other Cisco switch, Switch B. Firstly, we will enable Dynamic ARP Inspection for VLAN 2. Then, we will configure FastEthernet 0/1 and FastEthernet 0/2 as trusted interfaces.
Switch B# configure terminal
Switch B(config)# ip arp inspection vlan 2
Switch B(config)# interface fastethernet 0/1
Switch B(config-if)# ip arp inspection trust
Switch B(config)# interface fastethernet 0/2
Switch B(config-if)# ip arp inspection trust
DAI Verification
Now, it is time to verify our Dynamic ARP Inspection (DAI) configuration. To do this, we can use the show commands below on the Cisco switches:
Switch A# show ip arp inspection vlan 2
Source Mac Validation : Disabled
Destination Mac Validation : Disabled
IP Address Validation : Disabled
Vlan Configuration Operation ACL Match Static ACL
---- ------------- --------- --------- ----------
2 Enabled Active
Vlan ACL Logging DHCP Logging
---- ----------- ------------
2 Deny Deny
Switch A# show ip arp inspection interfaces fastethernet 0/1
Interface Trust State Rate (pps)
--------------- ----------- ----------
Fa0/1 Trusted None
Switch A# show ip arp inspection interfaces fastethernet 0/2
Interface Trust State Rate (pps)
--------------- ----------- ----------
Fa0/2 Untrusted None
Switch A# show ip arp inspection statistics vlan 2
Vlan Forwarded Dropped DHCP Drops ACL Drops
---- --------- ------- ---------- ----------
2 2 0 0 0
Vlan DHCP Permits ACL Permits Source MAC Failures
---- ------------ ----------- -------------------
2 2 0 0
Vlan Dest MAC Failures IP Validation Failures
---- ----------------- ----------------------
2 0 0
In this lesson, we have talked about DAI. We have learned what is DAI, how it works and how can we configure DAI on Cisco switches. ARP Packets are important in a network. So, defending your network from any malicious attacks related with ARP, Dynamic ARP Inspection is an important security mechanism.
ARP Spoofing Attack is one of the Man-in-the-middle Attacks. In such a network attack, attacker establishes connection to both ends as in all MiMT Attacks by poisoning the ARP tables of both ends. Attacker write, his MAC address as destination of the packets. Both ends think that they are directly connected but attacker located among them. After that attacker intercepts all the packets between these ends and he can change these packets or insert new ones.
ARP Spoofing
Dynamic ARP Inspection (DAI) protects against ARP Spoofing Attack, a Man-in-the-middle Attack and ARP Cache Poisoning.
If Dynamic ARP Inspection (DAI) is enabled on the switch, if an attacker sends a malicious ARP packet, it detects this malicious behavior and discard this ARP packet. If these attempts exceed a threshold, then switch generates alarms.
ARP (Address Resolution Protocol) is one of the common protocols of networking. The main duty of ARP is mapping IP address to MAC address. In other words, ARP maps layer 2 address to layer 3 address. How does ARP do this in a network? How does ARP Work? Let’s explain ARP mechanism step by step with the below simple topology.
Let’s think that, PC 1 will send a packet to PC 4 over this switch. To do this:
By the way, to check ARP Cache on a PC, we use “arp -a” command.
PC1:\> arp -a
Internet Address Physical Address Type
192.168.1.4 dd-dd-dd-dd-dd-dd dynamic
Dynamic ARP Inspection (DAI) protects ARP mechanism, switch ARP Caches, towards ARP Spoofing Attacks. DAI does this by configuring switch ports as trusted ports and untrusted ports as we have mentioned above
DAI protects against ARP Spoofing attacks with which attacker establish a connection as Man-in-the-middle attack and posion ARP tables on both ends.
DAI has two trust states: Trusted and Untrusted.
In global configuration mode, we can use “ip arp inspection vlan vlan-id” command to enable DAI in Cisco devices for a VLAN.
We use Dynamic ARP Inspection Juniper command, “set arp-inspection“, to enable DAI on Juniper routers.
Gokhan Kosem is a Network Engineer, Instructor and the Founder of IPCisco.com with 15+ years of experience in Cisco, Nokia, Huawei, Juniper, Linux, Service Provider Networks, Routing and Switching technologies.
He has worked on the backbone networks of major service providers and network vendors including Nortel, Alcatel-Lucent (Nokia) and has extensive hands-on experience with Cisco, Huawei, Juniper and Nokia networking technologies.
He has trained thousands of networking students worldwide through IPCisco.com, Udemy, books, labs, quizzes, and educational content across multiple social media platforms.
IPCisco.com | Best Route to Your Dreams
Leave a Reply