WEBVTT

1
00:00.000 --> 00:00.380 align:middle line:84%


2
00:00.380 --> 00:02.130 align:middle line:90%
You know what's really
cool, is that Cisco

3
00:02.130 --> 00:04.470 align:middle line:90%
creates a lot of
amazing functionality

4
00:04.470 --> 00:06.325 align:middle line:84%
and features in their products.

5
00:06.325 --> 00:08.700 align:middle line:90%
And what I'd like to do is
chat with you about a security

6
00:08.700 --> 00:11.220 align:middle line:90%
feature called Dynamic
ARP Inspection,

7
00:11.220 --> 00:13.920 align:middle line:90%
and explain to you in this
video why it's important, why

8
00:13.920 --> 00:16.115 align:middle line:84%
we need it, and how it works.

9
00:16.115 --> 00:19.290 align:middle line:90%
And so, one are the core ideas
about Dynamic ARP Inspection

10
00:19.290 --> 00:22.290 align:middle line:90%
is that we're going to protect
the network from devices

11
00:22.290 --> 00:26.430 align:middle line:90%
like PC-A or PC-B or PC-C
lying about what they're

12
00:26.430 --> 00:29.820 align:middle line:90%
layer 2 information is when
they respond and work with ARP.

13
00:29.820 --> 00:31.340 align:middle line:90%
So let's take a
look before there
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.820 --> 00:31.340 align:middle line:90%
So let's take a
look before there

14
00:31.340 --> 00:34.030 align:middle line:90%
is any maliciousness
with ARP messages,

15
00:34.030 --> 00:37.890 align:middle line:90%
and let's build in our
mind the ARP table in PC-A.

16
00:37.890 --> 00:39.480 align:middle line:90%
So let's imagine
that in this VLAN,

17
00:39.480 --> 00:41.930 align:middle line:90%
PC-A or Host-A was
talking to Host-C,

18
00:41.930 --> 00:45.000 align:middle line:90%
and in order to communicate,
PC-A did an ARP request

19
00:45.000 --> 00:47.580 align:middle line:90%
and discovered what
Host-C's MAC address was.

20
00:47.580 --> 00:50.160 align:middle line:90%
So in the ARP cache, here
in the mind of Host-A,

21
00:50.160 --> 00:53.430 align:middle line:90%
it would say, OK, to get to
the IP address of Host-C,

22
00:53.430 --> 00:55.320 align:middle line:90%
I'm going to go ahead
and use the MAC address

23
00:55.320 --> 00:57.510 align:middle line:84%
of Host-C. No problem.

24
00:57.510 --> 00:59.970 align:middle line:90%
And if we looked at
Host-C, its ARP cache

25
00:59.970 --> 01:01.900 align:middle line:84%
would look something like this.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.970 --> 01:01.900 align:middle line:84%
would look something like this.

26
01:01.900 --> 01:05.099 align:middle line:90%
It would say, to get to
Host-A it would use the IP

27
01:05.099 --> 01:10.740 align:middle line:90%
address of IP-A the MAC
address of Host-A. So

28
01:10.740 --> 01:12.700 align:middle line:90%
that looks pretty
straightforward,

29
01:12.700 --> 01:16.290 align:middle line:90%
and that's all well and good,
until this attacker steps in

30
01:16.290 --> 01:20.852 align:middle line:90%
and he is going to play the bad
guy running malicious software.

31
01:20.852 --> 01:22.560 align:middle line:90%
And what does this
malicious software do?

32
01:22.560 --> 01:25.445 align:middle line:90%
It's going to lie and it's going
to send out an ARP message--

33
01:25.445 --> 01:26.820 align:middle line:90%
and it could be
a gratuitous ARP,

34
01:26.820 --> 01:29.167 align:middle line:90%
meaning it wasn't an
ARP that was solicited.

35
01:29.167 --> 01:31.250 align:middle line:90%
And in the ARP message
that Host-B is sending out,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:29.167 --> 01:31.250 align:middle line:90%
And in the ARP message
that Host-B is sending out,

36
01:31.250 --> 01:37.740 align:middle line:90%
its saying, to get to IP-C, go
ahead and use my MAC address,

37
01:37.740 --> 01:42.310 align:middle line:90%
MAC-B. And if Host-A buys into
that, it updates its ARP cache

38
01:42.310 --> 01:43.555 align:middle line:84%
and says, OK, great.

39
01:43.555 --> 01:44.430 align:middle line:84%
Got your MAC address.

40
01:44.430 --> 01:45.223 align:middle line:84%
No problem.

41
01:45.223 --> 01:46.890 align:middle line:90%
If I ever need to
forward a frame to you

42
01:46.890 --> 01:49.415 align:middle line:90%
at your IP address, I'll send
it to your layer 2 address.

43
01:49.415 --> 01:51.540 align:middle line:90%
And then future frames, as
they go into the switch,

44
01:51.540 --> 01:53.345 align:middle line:90%
will be forwarded
to the attacker.

45
01:53.345 --> 01:55.470 align:middle line:90%
And the attacker would do
the same thing over here.

46
01:55.470 --> 01:58.470 align:middle line:90%
It would send out
a gratuitous ARP,

47
01:58.470 --> 02:02.417 align:middle line:90%
and then it would say, hey, to
get to IP address A, over here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:58.470 --> 02:02.417 align:middle line:90%
and then it would say, hey, to
get to IP address A, over here,

48
02:02.417 --> 02:04.500 align:middle line:90%
go ahead and use this MAC
address, which is MAC-B.

49
02:04.500 --> 02:05.880 align:middle line:84%
So Host-C says, oh!

50
02:05.880 --> 02:06.750 align:middle line:84%
Updated information!

51
02:06.750 --> 02:07.350 align:middle line:84%
Great!

52
02:07.350 --> 02:09.960 align:middle line:84%
I'm going to use MAC-B.

53
02:09.960 --> 02:12.480 align:middle line:90%
So now, if Host-A and Host-C
are talking to each other,

54
02:12.480 --> 02:16.290 align:middle line:90%
they're forwarding frames to the
attacker's layer 2 address, who

55
02:16.290 --> 02:17.607 align:middle line:84%
then can see all those packets.

56
02:17.607 --> 02:20.190 align:middle line:90%
And if the software is any good
that this attacker is running,

57
02:20.190 --> 02:22.200 align:middle line:90%
he very likely is
forwarding on the traffic

58
02:22.200 --> 02:24.210 align:middle line:90%
after he's had a chance
to either eavesdrop

59
02:24.210 --> 02:27.010 align:middle line:90%
and or manipulate that
traffic in transit.

60
02:27.010 --> 02:28.752 align:middle line:90%
So from Host-A and
Host-C's perspective,

61
02:28.752 --> 02:30.460 align:middle line:90%
they think they're
talking to each other.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:28.752 --> 02:30.460 align:middle line:90%
they think they're
talking to each other.

62
02:30.460 --> 02:33.780 align:middle line:90%
But in reality, it's
going through the Host-B.

63
02:33.780 --> 02:35.580 align:middle line:90%
So the question may
come up, OK, great.

64
02:35.580 --> 02:36.430 align:middle line:84%
That's a problem.

65
02:36.430 --> 02:37.410 align:middle line:84%
How do we solve it?

66
02:37.410 --> 02:41.490 align:middle line:90%
How do we prevent Host-B from
sending out bogus and incorrect

67
02:41.490 --> 02:43.390 align:middle line:84%
layer 2 ARP messages?

68
02:43.390 --> 02:47.970 align:middle line:90%
And the answer is
Dynamic ARP Inspection,

69
02:47.970 --> 02:49.640 align:middle line:84%
or as his friends call him--

70
02:49.640 --> 02:51.430 align:middle line:84%
DAI.

71
02:51.430 --> 02:53.490 align:middle line:90%
And so, if we apply
Dynamic ARP Inspection

72
02:53.490 --> 02:56.880 align:middle line:90%
to VLAN 30, all the ports in
VLAN 30 that are untrusted--

73
02:56.880 --> 02:59.608 align:middle line:90%
and by default, they're all
untrusted ports-- an now

74
02:59.608 --> 03:01.650 align:middle line:90%
there's an ARP message
that goes into the switch.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:59.608 --> 03:01.650 align:middle line:90%
there's an ARP message
that goes into the switch.

75
03:01.650 --> 03:04.110 align:middle line:90%
The switch is going to check,
hey, is that your IP address?

76
03:04.110 --> 03:05.975 align:middle line:90%
Hey is that your
layer 2 address?

77
03:05.975 --> 03:07.600 align:middle line:90%
And if there's any
shenanigans going on

78
03:07.600 --> 03:09.267 align:middle line:90%
and where they don't
line up, the switch

79
03:09.267 --> 03:10.980 align:middle line:90%
is simply going to
drop that ARP message

80
03:10.980 --> 03:12.510 align:middle line:90%
so it doesn't go
into the switch,

81
03:12.510 --> 03:14.880 align:middle line:90%
and does not reach
its intended victim.

82
03:14.880 --> 03:16.380 align:middle line:90%
So in this video,
we've taken a look

83
03:16.380 --> 03:18.990 align:middle line:90%
at the problem of a
device maliciously

84
03:18.990 --> 03:21.390 align:middle line:90%
lying about layer 2
address information

85
03:21.390 --> 03:23.655 align:middle line:90%
to other devices on
that same network.

86
03:23.655 --> 03:25.530 align:middle line:90%
We'll solve that with
Dynamic ARP Inspection,

87
03:25.530 --> 03:27.072 align:middle line:90%
and we'll take a
look at the commands

88
03:27.072 --> 03:29.370 align:middle line:90%
for implementing Dynamic
ARP Inspection in the very

89
03:29.370 --> 03:29.945 align:middle line:84%
next video.

90
03:29.945 --> 03:31.570 align:middle line:90%
So I'll see you there
in just a moment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:29.945 --> 03:31.570 align:middle line:90%
So I'll see you there
in just a moment.

91
03:31.570 --> 03:33.900 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

92
03:33.900 --> 03:37.130 align:middle line:90%
and I'd like to thank
you for viewing.