Configuring Arp Inspection For The Transparent Firewall; Information About Arp Inspection; Licensing Requirements For Arp Inspection - Cisco ASA 5505 Configuration Manual

Configuring ARP Inspection for the Transparent Firewall

Configuring ARP Inspection for the Transparent Firewall
This section describes ARP inspection and how to enable it and includes the following topics:
•
•
•
•
•
•

Information About ARP Inspection

By default, all ARP packets are allowed through the adaptive security appliance. You can control the
flow of ARP packets by enabling ARP inspection.
When you enable ARP inspection, the adaptive security appliance compares the MAC address, IP
address, and source interface in all ARP packets to static entries in the ARP table, and takes the
following actions:
•
•
•
ARP inspection prevents malicious users from impersonating other hosts or routers (known as ARP
spoofing). ARP spoofing can enable a "man-in-the-middle" attack. For example, a host sends an
ARP request to the gateway router; the gateway router responds with the gateway router MAC address.
The attacker, however, sends another ARP response to the host with the attacker MAC address instead
of the router MAC address. The attacker can now intercept all the host traffic before forwarding it on to
the router.
ARP inspection ensures that an attacker cannot send an ARP response with the attacker MAC address,
so long as the correct MAC address and the associated IP address are in the static ARP table.

Licensing Requirements for ARP Inspection

The following table shows the licensing requirements for this feature.
Model License Requirement
All models Base License.
Cisco ASA 5500 Series Configuration Guide using ASDM
5-8
Information About ARP Inspection, page 5-8
Licensing Requirements for ARP Inspection, page 5-8
Default Settings, page 5-9
Guidelines and Limitations, page 5-9
Configuring ARP Inspection, page 5-9
Feature History for ARP Inspection, page 5-11
If the IP address, MAC address, and source interface match an ARP entry, the packet is passed
through.
If there is a mismatch between the MAC address, the IP address, or the interface, then the adaptive
security appliance drops the packet.
If the ARP packet does not match any entries in the static ARP table, then you can set the adaptive
security appliance to either forward the packet out all interfaces (flood), or to drop the packet.
The dedicated management interface, if present, never floods packets even if this parameter
Note
is set to flood.
Chapter 5 Configuring the Transparent or Routed Firewall
OL-20339-01