Table of Contents
Advertisement
Configuring Security
Configuring Dynamic ARP Inspection
Cisco 220 Series Smart Plus Switches Administration Guide Release 1.0.0.x
How ARP Prevents Cache Poisoning
The ARP inspection feature relates to interfaces as either trusted or untrusted (see
Security > ARP Inspection > Interface Settings page).
Interfaces are classified by the user as follows:
•
Trusted—Packets are not inspected.
•
Untrusted—Packets are inspected as described above.
ARP inspection is performed only on untrusted interfaces. ARP packets that are
received on the trusted interface are simply forwarded.
Upon packet arrival on untrusted interfaces the following logic is implemented:
•
Search the ARP access control rules for the packet's IP/MAC addresses. If
the IP address is found and the MAC address in the list matches the
packet's MAC address, then the packet is valid; otherwise it is not.
•
If the packet's IP address was not found, and DHCP Snooping is enabled for
the packet's VLAN, search the DHCP Snooping Binding database for the
packet's <VLAN - IP address> pair. If the <VLAN - IP address> pair was
found, and the MAC address and the interface in the database match the
packet's MAC address and ingress interface, the packet is valid.
•
If the packet's IP address was not found in the ARP access control rules or
in the DHCP Snooping Binding database the packet is invalid and is
dropped. A SYSLOG message is generated.
•
If a packet is valid, it is forwarded and the ARP cache is updated.
If the ARP Packet Validation option is selected (on the Properties page), the
following additional validation checks are performed:
•
Source MAC Address—Compares the packet's source MAC address in the
Ethernet header against the sender's MAC address in the ARP request. This
check is performed on both ARP requests and responses.
•
Destination MAC Address—Compares the packet's destination MAC
address in the Ethernet header against the destination interface's MAC
address. This check is performed for ARP responses.
•
IP Address—Compares the ARP body for invalid and unexpected IP
addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP Multicast
addresses.
Packets with invalid ARP Inspection bindings are logged and dropped.
16
219
Advertisement
Table of Contents
