DHCP Snooping

Switch#show ip dhcp

snooping

Switch DHCP snooping

is enabled

DHCP snooping is configured on following

VLANs:

104

Insertion of option

82 is enabled

Interface

Trusted

Rate limit (pps)

FastEthernet0/35

no

3

FastEthernet0/36

no

3

GigabitEthernet0/1

yes

unlimited

Switch#

Address spoofing is one type of attack that can be difficult to mitigate. Normally, a host is assigned an IP address and is expected to use that address in all the traffic it sends out. IP addresses are effectively used on the honor system, where hosts are trusted to behave themselves and use their own legitimate source addresses.

A rogue or compromised host PC doesn't necessarily play by those rules. It can use its legitimate address, or it can begin to use spoofed addresses—borrowed from other hosts or used at random. Spoofed addresses are often used to disguise the origin of denial-of-service attacks. If the source address doesn't really exist, no return traffic will find its way back to the originator.

Routers or Layer 3 devices can perform some simple tests to detect spoofed source addresses in packets passing through. For example, if the 10.10.0.0 network is known to exist on VLAN 10, packets entering from VLAN 20 should never have source addresses in that subnet.

However, it is difficult to detect spoofed addresses when they are used inside the VLAN or subnet where they should already exist. For example, within the 10.10.0.0 network on VLAN 10, as shown in Figure 15-1, a rogue host begins to send packets with a spoofed source address of 10.10.10.10. The 10.10.10.10 address is certainly within the 10.10.0.0/16 subnet, so it doesn't stand out as an obvious spoof. Therefore, the rogue host might be very successful in attacking other hosts in its own subnet or VLAN.

Figure 15-1 Using a Spoofed Address Within a Subnet

Figure 15-1 Using a Spoofed Address Within a Subnet

Cisco Catalyst switches can use the IP source guard feature to detect and suppress address spoofing attacks—even if they occur within the same subnet. A Layer 2 switch, and a Layer 2 port in turn, normally learns and stores MAC addresses. The switch must have a way to look up MAC addresses and find out what IP address are associated with them.

IP source guard does this by making use of the DHCP snooping database, as well as static IP source binding entries. If DHCP snooping is configured and enabled, the switch learns the MAC and IP addresses of hosts that use DHCP. Packets arriving on a switch port can be tested for one of the following conditions:

■ The source IP address must be identical to the IP address learned by DHCP snooping or a static entry. A dynamic port ACL is used to filter traffic. The switch automatically creates this ACL, adds the learned source IP address to the ACL, and applies the ACL to the interface where the address is learned.

■ The source MAC address must be identical to the MAC address learned on the switch port and by DHCP snooping. Port security is used to filter traffic.

If the address is something other than the one learned or statically configured, the switch will drop the packet.

To configure IP source guard, first configure and enable DHCP snooping, as presented in the previous section. If you want IP source guard to detect spoofed MAC addresses, you will also need to configure and enable port security.

For the hosts that don't use DHCP, you can configure a static IP source binding with the following configuration command:

Switch(config)#ip source binding mac-address vlan vlan-id ip-address interface type mod/num

Here, the host's MAC address is bound to a specific VLAN and IP address, and is expected to be found on a specific switch interface.

Next, enable IP source guard on one or more switch interfaces with the following configuration commands:

Switch(config)#interface type mod/num Switch(config-if)#ip verify source [port-security]

The ip verify source command will inspect the source IP address only. You can add the port-security keyword to inspect the source MAC address, too.

To verify the IP source guard status, you can use the following EXEC command:

Switch#show ip verify source [interface type mod/num] If you need to verify the information contained in the IP source binding database, either learned or statically configured, you can use the following EXEC command:

Switch#show ip source bindng [ip-address] [mac-address] [dhcp-snooping I static]

[interface type mod/num] [vlan vlan-id]

Dynamic ARP Inspection

Hosts normally use the Address Resolution Protocol (ARP) to resolve an unknown MAC address when the IP address is known. If a MAC address is needed so that a packet can be forwarded at Layer 2, a host broadcasts an ARP request that contains the IP address of the target in question. If any other host is using that IP address, it responds with an ARP reply containing its MAC address.

The ARP process works well among trusted and well-behaved users. However, suppose that an attacker could send its own crafted ARP reply when it overhears an ARP request being broadcast. The reply could contain its own MAC address, causing the original requester to think that it is bound to the IP address in question. The requester would add the bogus ARP entry into its own ARP cache, only to begin forwarding packets to the spoofed MAC address.

In effect, this scheme places the attacker's machine right in the middle of an otherwise legitimate path. Packets will be sent to the attacker instead of another host or the default gateway. The attacker will be able to intercept packets and (perhaps) will forward them on only after examining the packets' contents.

This attack is known as ARP poisoning or ARP spoofing, and it is considered to be a type of man-in-the-middle attack. The attacker wedges into the normal forwarding path, transparent to the end users. Cisco Catalyst switches can use the dynamic ARP inspection (DAI) feature to help mitigate this type of attack.

DAI works much like DHCP snooping. All switch ports are classified as trusted or untrusted. The switch intercepts and inspects all ARP packets that arrive on an untrusted port; no inspection is done on trusted ports.

When an ARP reply is received on an untrusted port, the switch checks the MAC and IP addresses reported in the reply packet against known and trusted values. A switch can gather trusted ARP information from statically configured entries or from dynamic entries in the DHCP snooping database. In the latter case, DHCP snooping must be enabled in addition to DAI.

If an ARP reply contains invalid information or values that conflict with entries in the trusted database, it is dropped and a log message is generated. This action prevents invalid or spoofed ARP entries from being sent and added to other machines' ARP caches.

You can configure DAI by first enabling it on one or more client VLANs with the following configuration command:

Switch(config)#ip arp inspection vlan vlan-range

The VLAN range can be a single VLAN ID, a range of VLAN IDs separated by a hyphen, or a list of VLAN IDs separated by commas.

By default, all switch ports associated with the VLAN range are considered to be untrusted. You should identify trusted ports as those that connect to other switches. In other words, the local switch will not inspect ARP packets arriving on trusted ports; it will assume that the neighboring switch also is performing DAI on all of its ports in that VLAN. Configure a trusted port with the following interface configuration command:

Switch(config)#interface type mod/num Switch(config-if)#ip arp inspection trust

If you have hosts with statically configured IP address information, there will be no DHCP message exchange that can be inspected. Instead, you can configure an ARP access list that defines static MAC-IP address bindings that are permitted. Use the following configuration commands to define the ARP access list and one or more static entries:

Switch(config)#arp access-list acl-name

Switch(config-acl)#permit ip host sender-ip mac host sender-mac [log]

[Repeat the previous command as needed]

Switch(config-acl)#exit

Now the ARP access list must be applied to DAI with the following configuration command:

Switch(config)#ip arp inspection filter arp-acl-name vlan vlan-range [static]

When ARP replies are intercepted, their contents are matched against the access list entries first. If no match is found, the DHCP snooping bindings database is checked next. You can give the static keyword to prevent the DHCP bindings database from being checked at all. In effect, this creates an implicit deny statement at the end of the ARP access list; if no match is found in the access list, the ARP reply is considered to be invalid.

Finally, you can specify further validations on the contents of ARP reply packets. By default, only the MAC and IP addresses contained within the ARP reply are validated. This doesn't take the actual MAC addresses contained in the Ethernet header of the ARP reply.

To validate that an ARP reply packet is really coming from the address listed inside it, you can enable DAI validation with the following configuration command:

Switch(config)#ip arp inspection validate {[src-mac] [dst-mac] [ip]} Be sure to specify at least one of the options:

■ src-mac—Check the source MAC address in the Ethernet header against the sender MAC address in the ARP reply.

■ dst-mac—Check the destination MAC address in the Ethernet header against the target MAC address in the ARP reply.

■ ip—Check the sender's IP address in all ARP requests; check the sender's IP address against the target IP address in all ARP replies.

Example 15-7 demonstrates where DAI is enabled for all switch ports associated with VLAN 104 on an access-layer switch. The uplink to a distribution switch is considered to be trusted.

Example 15-7 Configuring DAI to Validate ARP Replies

Switch(config)#ip arp inspection vlan 104 Switch(config)#arp access-list StaticARP

Switch(config-acl)#permit ip host 192.168.1.10 mac host 0006.5b02.a841

Switch(config-acl)#exit

Switch(config)#ip arp inspection filter StaticARP vlan 104 Switch(config)#interface gigabitethernet 0/1 Switch(config-if)#ip arp inspection trust

You can display DAI status information with the show ip arp inspection command.