Cisco ESW 500 - Defining Dynamic ARP Inspection

Configuring Device Security
Defining Dynamic ARP Inspection
ESW 500 Series Switches Administration Guide 191
5
- VLAN — Indicates that DHCP Snooping is not enabled on the VLAN.
- Truste d Por t — Indicates the port is a trusted port.
- Resource Problem — Indicates that the TCAM is full.
STEP 4 Define the relevant fields. Click Apply and the device is updated.
Defining Dynamic ARP Inspection
Dynamic Address Resolution Protocol (ARP) is a TCP/IP protocol for translating IP
addresses into MAC addresses. Classic ARP does the following:
• Permits two hosts on the same network to communicates and send packets.
• Permits two hosts on different packets to communicate via a gateway.
• Permits routers to send packets via a host to a different router on the same
network.
• Permits routers to send packets to a destination host via a local host.
ARP Inspection intercepts, discards, and logs ARP packets that contain invalid IP-
to-MAC address bindings. This eliminates man-in-the-middle attacks, where false
ARP packets are inserted into the subnet. Packets are classified as:
• Trusted — Indicates that the interface IP and MAC address are recognized,
and recorded in the ARP Inspection List. Trusted packets are forward without
ARP Inspection.
• Untrusted — Indicates that the packet arrived from an interface that does not
have a recognized IP and MAC addresses. The packet is checked for:
- Source MAC — Compares the packet’s source MAC address in the
Ethernet header against the sender’s MAC address in the ARP request.
This check is performed on both ARP requests and responses.
- Destination MAC — Compares the packet’s destination MAC address in
the Ethernet header against the destination interface’s MAC address.
This check is performed for ARP responses.
- IP Addresses — Checks the ARP body for invalid and unexpected IP
addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP
Multicast addresses.