Cisco 500 series Administration Manual page 342

Configuring Security
Dynamic ARP Inspection
Cisco 500 Series Stackable Managed Switch Administration Guide
Hosts A, B, and C are connected to the switch on interfaces A, B and C, all of which
are on the same subnet. Their IP, MAC addresses are shown in parentheses; for
example, Host A uses IP address IA and MAC address MA. When Host A needs to
communicate with Host B at the IP layer, it broadcasts an ARP request for the MAC
address associated with IP address IB. Host B responds with an ARP reply. The
switch and Host A update their ARP cache with the MAC and IP of Host B.
Host C can poison the ARP caches of the switch, Host A, and Host B by
broadcasting forged ARP responses with bindings for a host with an IP address of
IA (or IB) and a MAC address of MC. Hosts with poisoned ARP caches use the
MAC address MC as the destination MAC address for traffic intended for IA or IB,
which enables Host C intercepts that traffic. Because Host C knows the true MAC
addresses associated with IA and IB, it can forward the intercepted traffic to those
hosts by using the correct MAC address as the destination. Host C has inserted
itself into the traffic stream from Host A to Host B, the classic man-in-the-middle
attack.
How ARP Prevents Cache Poisoning
The ARP inspection feature relates to interfaces as either trusted or untrusted (see
Security > ARP Inspection > Interface Setting page).
Interfaces are classified by the user as follows:
• Trusted — Packets are not inspected.
• Untrusted —Packets are inspected as described above.
ARP inspection is performed only on untrusted interfaces. ARP packets that are
received on the trusted interface are simply forwarded.
Upon packet arrival on untrusted interfaces the following logic is implemented:
• Search the ARP access control rules for the packet's IP/MAC addresses. If
the IP address is found and the MAC address in the list matches the
packet's MAC address, then the packet is valid; otherwise it is not.
• If the packet's IP address was not found, and DHCP Snooping is enabled for
the packet's VLAN, search the DHCP Snooping Binding database for the
packet's <VLAN - IP address> pair. If the <VLAN - IP address> pair was
found, and the MAC address and the interface in the database match the
packet's MAC address and ingress interface, the packet is valid.
• If the packet's IP address was not found in the ARP access control rules or
in the DHCP Snooping Binding database the packet is invalid and is
dropped. A SYSLOG message is generated.
18
342