Adding A Static Arp Entry; Enabling Arp Inspection - Cisco 7604 Configuration Manual

Configuring ARP Inspection
ARP inspection prevents malicious users from impersonating other hosts or routers (known as ARP
spoofing). ARP spoofing can enable a "man-in-the-middle" attack. For example, a host sends an
ARP request to the gateway router; the gateway router responds with the gateway router MAC address.
The attacker, however, sends another ARP response to the host with the attacker MAC address instead
of the router MAC address. The attacker can now intercept all the host traffic before forwarding it on to
the router.
ARP inspection ensures that an attacker cannot send an ARP response with the attacker MAC address,
so long as the correct MAC address and the associated IP address are in the static ARP table.

Adding a Static ARP Entry

ARP inspection compares ARP packets with static ARP entries in the ARP table. To add a static ARP
entry, enter the following command:
hostname(config)# arp interface_name ip_address mac_address
Where the interface_name is the source interface for the ARP packets. The ip_address is the source
address, and mac_address is the associated MAC address.
For example, to allow ARP responses from the router at 10.1.1.1 with the MAC address 0009.7cbe.2100
on the outside interface, enter the following command:
hostname(config)# arp outside 10.1.1.1 0009.7cbe.2100
The transparent firewall uses dynamic ARP entries in the ARP table for traffic to and from the FWSM,
Note
such as management traffic.

Enabling ARP Inspection

To enable ARP inspection, enter the following command:
hostname(config)# arp-inspection interface_name enable [flood | no-flood]
Where the interface_name is the interface on which you want to enable ARP inspection. The flood
keyword forwards non-matching ARP packets out all interfaces, and no-flood drops non-matching
packets.
Note The default setting is to flood non-matching packets. To restrict ARP through the FWSM to only static
entries, then set this command to no-flood.
For example, to enable ARP inspection on the outside interface, and to drop all non-matching ARP
packets, enter the following command:
hostname(config)# arp-inspection outside enable no-flood
To view the current settings for ARP inspection on all interfaces, enter the show arp-inspection
command.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
19-2
Chapter 19 Configuring ARP Inspection and Bridging Parameters
OL-20748-01