Lab Objective:
In this lab, you will learn how to configure layer 2 security feature called Dynamic ARP Inspection or DAI to protect the network against malicious ARP packets.
Lab Purpose:
Dynamic ARP Inspection depends on Dynamic Host Configuration Protocol (DHCP) snooping. Once DHCP issues the IP information out, it will take the MAC address, map it to the IP address, and store it on the switch. When another device is connected to the network, and its MAC address and IP address do not match an entry in the DHCP snooping bindings database, the switch drops an ARP packet.
Lab Tool:
You will need to use live Cisco equipment or the Graphic Network Simulator-3 (GNS3) for this lab because Packet Tracer doesn’t support DAI.
Lab Topology:
Please use the following topology to complete this lab exercise (GNS3 with IOSvL2 is used for this lab).
Task 1:
Configure the hostnames and IP address on R1 as illustrated in the topology. You have done this in earlier labs.
Task 2:
Configure the DHCP scope on R1.
R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#ip dhcp pool mypool
R1(dhcp-config)#network 192.168.10.0 255.255.255.0
R1(dhcp-config)#ip dhcp relay information trust-all
Task 3:
Use default VLAN 1 on switch SW1 and configure all three ports as access ports.
SW1#config t
Enter configuration commands, one per line. End with CNTL/Z.
SW1(config)#int gi0/0
SW1(config-if)#switchport mode access
SW1(config-if)#int gi0/1
SW1(config-if)#switchport mode access
SW1(config-if)#int gi0/2
SW1(config-if)#switchport mode access
Task 4:
Enable DHCP snooping on switch SW1 and configure port Gi0/2 as a DHCP snooping trust port.
Verify using the following command:
- show ip dhcp binding ( on R1)
- show ip dhcp snooping binding (on SW1)
SW1#config t
SW1(config)#ip dhcp snooping
SW1(config)#ip dhcp snooping vlan 1
SW1(config)#int gi0/2
SW1(config-if)#ip dhcp snooping trust
PC now should be able to get an IP from DHCP (configured on R1)
PC> ping 192.168.10.254
84 bytes from 192.168.10.254 icmp_seq=1 ttl=255 time=6.759 ms
84 bytes from 192.168.10.254 icmp_seq=2 ttl=255 time=14.000 ms
84 bytes from 192.168.10.254 icmp_seq=3 ttl=255 time=12.774 ms
84 bytes from 192.168.10.254 icmp_seq=4 ttl=255 time=15.825 ms
84 bytes from 192.168.10.254 icmp_seq=5 ttl=255 time=11.043 ms
R1#sh ip dhcp binding
Bindings from all pools not associated with VRF:
IP address Client-ID/ Lease expiration Type State Interface
Hardware address/
Username
192.168.10.1 0100.5079.6668.00 Jun15 2020 03:36PM Auto Active Gi0/0
Switch#show ip dhcp snooping binding
MacAddress IpAddress Lease(sec) Type VLAN Interface
—————— ————— ———- ————- —- ——————–
00:50:79:66:68:00 192.168.10.1 80246 dhcp-snooping 1 GigabitEthernet0/1
Total number of bindings: 1
Task 5:
On switch SW1, enable ARP inspection on VLAN 1 and configure port Gi0/1 and Gi0/2 as ARP inspection trust ports.
SW1#config t
SW1(config)#ip arp inspection vlan 1
SW1(config)#int gi0/1
SW1(config-if)#ip arp inspection trust
SW1(config-if)#int gi0/2
SW1(config-if)#ip arp inspection trust
Task 6:
Assign a static IP 192.168.10.2/24 to an attacker PC and ping R1’s IP.
Attacker> show ip
NAME : Attacker[1]
IP/MASK : 192.168.10.2/24
Attacker> ping 192.168.10.254
host (192.168.10.254) not reachable
SW1(config)#
*Jun 14 07:14:05.474: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi0/0, vlan 1.([0050.7966.6801/192.168.10.1/ffff.ffff.ffff/192.168.10.254/07:14:04 UTC Sun Jun 14 2020])
*Jun 14 07:14:06.484: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi0/0, vlan 1.([0050.7966.6801/192.168.10.1/ffff.ffff.ffff/192.168.10.254/07:14:05 UTC Sun Jun 14 2020])
*Jun 14 07:14:07.536: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi0/0, vlan 1.([0050.7966.6801/192.168.10.1/ffff.ffff.ffff/192.168.10.254/07:14:06 UTC Sun Jun 14 2020])
As you can see, Attacker PC is not able to ping R1 IP address, and invalid ARP log entries would show up under switch SW1.
