And while I have ya, are you up for just one more
little tweak that we can add on top of Dynamic ARP Inspection?
[MUSIC PLAYING]
Because it's pretty cool.
What happens by default when DAI--
Dynamic ARP Inspection-- is installed or enabled,
is that it rate-limits ARP traffic on a port to 15
ARP messages per second.
Now, that seems like it should be
adequate for any normal activity,
but as soon as it sees anything malicious like a ping sweep
of the whole network, and they're
trying to ARP for every single IP address in that subnet, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
trying to ARP for every single IP address in that subnet,
they could be cranking a lot higher rates than that,
and Dynamic ARP Inspection can stop that.
So the default rate limiting is 15.
So I'd like to show you where you can go to see that,
and also how you can change it.
So the way that we could see the current rate limiting
for Dynamic ARP Inspections is with the command show, IP, ARP,
inspection, and then the keyword interfaces.
And press Enter.
And this will also show whether or not
the interfaces are trusted or not, so gig 3/3
we specifically made as a trusted
port from a DAI perspective. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
port from a DAI perspective.
And then the rate packets per second regarding all ARP
traffic on the untrusted ports is 15 packets
per second by default. And if we wanted to change that,
we could.
We'd go to interface gig 0/1 and do an IP ARP Inspection.
Question mark, limit, space, rate, space, and then the rate
we want to give it.
So let's say we wanted to, for some reason,
allow up to 100 packets per second
on that interface regarding ARP traffic.
We could put that in, and then use the upper arrow key WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We could put that in, and then use the upper arrow key
and do that command again, and verify that it made the change.
Now, just for fun, if we wanted to test that, what we could do
is go to our Kali Linux box in the lab.
And here at the Kali Linux box, we could just do a simple nmap.
So with nmap, we could do a sweep of the network
and we could just try to find all the devices that are there.
And if there is 254 possible addresses,
it's going to do ARPs for 254 addresses,
and that's very likely going to trigger even our 100 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and that's very likely going to trigger even our 100
threshold within a second.
So we'll put in 10.16.20.0 with a 24-bit mask.
(LAUGHS)
And I'll work with my Num Locks there.
Darn it.
All right.
With my Num Locks adjusted--
10.16.20.0/24.
Great.
And we'll go into ahead and do our scan.
Now, if we go back to the console at DC-NUG,
if we violate that, it'll let us know.
And sure enough, there it is.
103 packets received in 630 milliseconds. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
103 packets received in 630 milliseconds.
That port is now in error disabled state.
So we do show, interface status, error disabled, press Enter.
And there it is.
And to bring it back up manually,
we'd go into configuration mode, interface, gig 0/1,
we do a shut down and a no shut down.
And that will bring it back up.
And while we're here, let's go back to the Kali Linux box,
and let's do one more fun little thing.
So here's the Linux box.
There's a tool called arpspoof.
If we press Enter, it's pretty straightforward. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we press Enter, it's pretty straightforward.
You type in arpspoof, space, dash I,
the interface you want to use-- we're
going to use ethernet zero, space.
And then a quick way of doing it is putting in the default
gateway's address.
This is mean, but 10.16.20.7 I believe is R3's address.
Let's go check that real quick.
So we'll go over to R3, do a show IP interface brief.
Sure enough, for VLAN 30, that's his IP address.
So if we go back to Kali Linux box and we do this command. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we go back to Kali Linux box and we do this command.
What this is going to do is it's going to send out a broadcast
response, an ARP response, claiming that the layer 2
address of 10.16.20.7--
the default gateway-- is the layer 2 address
of ethernet zero on this Kali Linux box.
And it's just going to go on till we stop it.
So there you go.
So sending that out as a broadcast over, and over,
and over again.
But great news everybody, we've got Dynamic ARP Inspection
enabled.
So let's go take a look at the switch console. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's go take a look at the switch console.
So back here at our switch, that is just being denied again,
and again, and again.
Now, this is not putting the port in an error
disabled state, it's just denying
all of those ARP messages that the Kali Linux
box is trying to pump in there.
And they're being delayed because he's
lying about the layer 3, layer 2 mapping in his ARP messages
that he's sending as broadcast into the network.
So we'll go back to the Kali Linux box,
and we will do a Control-C to stop that.
And then we go back to our Admin PC and we'll do a show log, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we go back to our Admin PC and we'll do a show log,
and then hit Space a few times.
We can just ruminate on all those denies
due to Dynamic ARP Inspection doing a great job of protecting
the network.
And there's actually just one more tip
that I'd like to add regarding DIA--
Dynamic ARP Inspection to make it even more secure.
Check this out.
On the switch, if we do a show IP ARP inspection
for VLAN 30 and press Enter, you'll
notice that it's enabled.
We've got our access list.
But these three options right here-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But these three options right here--
Source Mac Validation, Destination Mac Validation,
and IP Address Validation-- those are disabled by default.
So in addition to Dynamic ARP Inspection's normal job
of looking at ARP responses, and then if they're not valid,
IP to MAC mappings dropping those,
it can also do these three additional validation checks.
But they're not enabled by default.
For source MAC validation, Dynamic ARP Inspection is going
to check the MAC address in a layer 2
header against the sender MAC address in the ARP response. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
header against the sender MAC address in the ARP response.
For destination MAC, it's going to check the destination MAC
address in the ethernet layer 2 header against the target MAC
address that's part of the ARP response.
And for IP, it's just looking for unexpected bogus types
of IP information that might be included
as part of an ARP response.
And to enable them it's a one-liner.
So if we go into configuration mode--
IP, ARP, inspection.
We said we had the command to validate,
and then we add the option that we
want to validate-- destination Mac address, IP information, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
want to validate-- destination Mac address, IP information,
and source MAC address.
Just like that.
And then we press Enter.
Then, if we do it up arrow key again for that same command--
show IP ARP inspection for VLAN 30,
now those three additional checks
are being done regarding ARP messages.
So as a result of our time together in these videos
and labs, we've had the opportunity
to configure ARP inspection a couple of times,
configure ARP access lists as additional information
for Dynamic ARP Inspection to map out the layer 3
and layer 2 mappings in addition to what's
in the DHCP snooping table. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the DHCP snooping table.
We've also a chance to verify the results.
So I've enjoyed having you in this journey through the world
of Dynamic ARP Inspection, and I look forward
to seeing you in the next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.