WEBVTT

1
00:00.000 --> 00:00.820 align:middle line:84%


2
00:00.820 --> 00:02.560 align:middle line:90%
From the previous
video, we identified

3
00:02.560 --> 00:05.020 align:middle line:90%
that a device lying
in ARP messages

4
00:05.020 --> 00:06.730 align:middle line:90%
about layer 2
address information

5
00:06.730 --> 00:08.150 align:middle line:84%
is bad news for the network.

6
00:08.150 --> 00:10.660 align:middle line:90%
So we're going to solve it
with Dynamic ARP Inspection--

7
00:10.660 --> 00:11.512 align:middle line:84%
DAI.

8
00:11.512 --> 00:12.970 align:middle line:90%
So in this video,
let's take a look

9
00:12.970 --> 00:15.320 align:middle line:90%
at the syntax for how
we would apply it,

10
00:15.320 --> 00:16.780 align:middle line:90%
and we'll also have
the opportunity

11
00:16.780 --> 00:20.710 align:middle line:90%
to talk about the concept of a
Dynamic ARP Inspection trusted

12
00:20.710 --> 00:22.330 align:middle line:84%
interface as well.

13
00:22.330 --> 00:25.090 align:middle line:90%
And let's use this topology as
our backdrop for the discussion

14
00:25.090 --> 00:28.010 align:middle line:90%
for a Dynamic ARP Inspection
and how to implement it.

15
00:28.010 --> 00:31.130 align:middle line:90%
So we'd start off with a switch
that supports Dynamic ARP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:28.010 --> 00:31.130 align:middle line:90%
So we'd start off with a switch
that supports Dynamic ARP

16
00:31.130 --> 00:31.630 align:middle line:84%
Inspection.

17
00:31.630 --> 00:32.698 align:middle line:84%
It has the feature set.

18
00:32.698 --> 00:34.240 align:middle line:90%
And one of the
questions that we have

19
00:34.240 --> 00:36.940 align:middle line:90%
to ask ourselves is, well,
if the switch is going

20
00:36.940 --> 00:39.640 align:middle line:90%
to check on the ports for
ARP messages and make sure

21
00:39.640 --> 00:41.110 align:middle line:90%
that the correct
layer 3 addresses

22
00:41.110 --> 00:44.290 align:middle line:90%
map to the right layer 2
address, how does it know?

23
00:44.290 --> 00:45.520 align:middle line:84%
That's a good question.

24
00:45.520 --> 00:47.328 align:middle line:90%
The primary way,
when we implement

25
00:47.328 --> 00:49.120 align:middle line:90%
this, that the switch
is going to know what

26
00:49.120 --> 00:51.235 align:middle line:90%
the corresponding layer
3 and layer 2 address is,

27
00:51.235 --> 00:53.540 align:middle line:84%
is from the DHCP snooping.

28
00:53.540 --> 00:56.680 align:middle line:90%
So unless we want to manually
configure all of the mappings

29
00:56.680 --> 00:58.420 align:middle line:90%
for all of our
clients with this IP

30
00:58.420 --> 00:59.980 align:middle line:90%
address and this
MAC address, we'd

31
00:59.980 --> 01:02.300 align:middle line:84%
want to rely on DHCP snooping.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
00:59.980 --> 01:02.300 align:middle line:84%
want to rely on DHCP snooping.

32
01:02.300 --> 01:05.140 align:middle line:90%
So it's pretty cool that that
information with DHCP snooping

33
01:05.140 --> 01:09.010 align:middle line:90%
can be used by Dynamic ARP
Inspection for the ARP checks.

34
01:09.010 --> 01:11.240 align:middle line:90%
So we have a router that's
connected to a switch.

35
01:11.240 --> 01:12.760 align:middle line:90%
There's a trunk
here, which implies

36
01:12.760 --> 01:14.985 align:middle line:90%
we may have some multiple
sub-interfaces here.

37
01:14.985 --> 01:17.110 align:middle line:90%
And then from the switch
we have a couple of ports.

38
01:17.110 --> 01:19.960 align:middle line:90%
Gig 0/1 is associated
with VLAN 30.

39
01:19.960 --> 01:23.320 align:middle line:84%
Here's the subnet of 10.16.20.0.

40
01:23.320 --> 01:25.870 align:middle line:90%
And to implement Dynamic
ARP Inspection for VLAN 30,

41
01:25.870 --> 01:26.680 align:middle line:84%
here's what we do.

42
01:26.680 --> 01:28.840 align:middle line:90%
We'd use this command
in global config--

43
01:28.840 --> 01:31.900 align:middle line:90%
IP, space, ARP, space,
inspection, space, VLAN, space,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:28.840 --> 01:31.900 align:middle line:90%
IP, space, ARP, space,
inspection, space, VLAN, space,

44
01:31.900 --> 01:32.400 align:middle line:84%
30.

45
01:32.400 --> 01:32.980 align:middle line:84%
Press Enter.

46
01:32.980 --> 01:33.870 align:middle line:84%
Boom!

47
01:33.870 --> 01:34.960 align:middle line:84%
And it's applied.

48
01:34.960 --> 01:37.090 align:middle line:90%
Now, every ARP message
that goes into the switch

49
01:37.090 --> 01:38.170 align:middle line:84%
is going to be checked.

50
01:38.170 --> 01:40.628 align:middle line:90%
It's going to say, hey, is that
the correct layer 2 address

51
01:40.628 --> 01:42.880 align:middle line:90%
that you're advertising,
or you're responding with

52
01:42.880 --> 01:44.690 align:middle line:84%
based on your IP address?

53
01:44.690 --> 01:46.720 align:middle line:90%
And if it's not, it's
going to deny that message

54
01:46.720 --> 01:47.900 align:middle line:84%
from entering the switch.

55
01:47.900 --> 01:50.890 align:middle line:90%
Now, a really important question
is, how does the switch know?

56
01:50.890 --> 01:53.950 align:middle line:90%
How does the switch know what
the corresponding IP and MAC

57
01:53.950 --> 01:54.740 align:middle line:84%
addresses are?

58
01:54.740 --> 01:55.750 align:middle line:84%
That's a good question.

59
01:55.750 --> 01:58.960 align:middle line:90%
And one way, and the most
popular way of implanting this,

60
01:58.960 --> 02:02.080 align:middle line:84%
is by using DHCP snooping also.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
01:58.960 --> 02:02.080 align:middle line:84%
is by using DHCP snooping also.

61
02:02.080 --> 02:03.640 align:middle line:90%
See, if we use DHCP
snooping, which

62
02:03.640 --> 02:05.230 align:middle line:90%
we covered in
separate Skill, it's

63
02:05.230 --> 02:06.850 align:middle line:90%
going to listen
to DHCP messages,

64
02:06.850 --> 02:08.740 align:middle line:90%
and it will dynamically
build a table

65
02:08.740 --> 02:11.350 align:middle line:90%
that has the IP address
and the layer 2 addresses.

66
02:11.350 --> 02:12.610 align:middle line:84%
And now DAI--

67
02:12.610 --> 02:14.842 align:middle line:90%
Dynamic ARP Inspection--
swoops in and says,

68
02:14.842 --> 02:16.300 align:middle line:90%
great, I'm going
to use that table.

69
02:16.300 --> 02:17.820 align:middle line:84%
Thanks DHCP snooping!

70
02:17.820 --> 02:19.870 align:middle line:90%
I'm going to use that
table as I verify

71
02:19.870 --> 02:21.820 align:middle line:90%
the responses in MAC
addresses to make sure

72
02:21.820 --> 02:24.950 align:middle line:90%
that nobody's lying about
their layer 2 information.

73
02:24.950 --> 02:26.020 align:middle line:84%
That's how it works.

74
02:26.020 --> 02:29.350 align:middle line:90%
So although it's possible to
configure all our devices--

75
02:29.350 --> 02:31.900 align:middle line:90%
their layer 3 layer 2
information manually--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:29.350 --> 02:31.900 align:middle line:90%
their layer 3 layer 2
information manually--

76
02:31.900 --> 02:35.500 align:middle line:90%
the most popular way is to
also include DHCP snooping,

77
02:35.500 --> 02:37.600 align:middle line:90%
and that will capture all
the layer 3 and layer 2

78
02:37.600 --> 02:39.610 align:middle line:84%
mappings for our DHCP clients.

79
02:39.610 --> 02:42.850 align:middle line:90%
Now, what about devices
that are not DHCP clients?

80
02:42.850 --> 02:45.327 align:middle line:90%
Like router 3, it's
not a DHCP client.

81
02:45.327 --> 02:46.160 align:middle line:84%
What do we do there?

82
02:46.160 --> 02:49.900 align:middle line:90%
Well, we can manually statically
configure the layer 3 and layer

83
02:49.900 --> 02:52.450 align:middle line:90%
2 mapping and tell Dynamic
ARP Inspection to use that,

84
02:52.450 --> 02:56.110 align:middle line:90%
or we can specify this
port on the switch

85
02:56.110 --> 02:59.050 align:middle line:90%
where R3 is connected
as a trusted port.

86
02:59.050 --> 03:01.540 align:middle line:90%
And so if R3 is
associated with VLAN 30,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
02:59.050 --> 03:01.540 align:middle line:90%
And so if R3 is
associated with VLAN 30,

87
03:01.540 --> 03:04.550 align:middle line:90%
but this port is a trusted
port, the switch says, ah,

88
03:04.550 --> 03:07.480 align:middle line:90%
you know, ARP messages coming in
that port, not going to check.

89
03:07.480 --> 03:08.480 align:middle line:84%
Your free and clear.

90
03:08.480 --> 03:09.277 align:middle line:84%
Have a good day.

91
03:09.277 --> 03:11.110 align:middle line:90%
While at the same time,
all the other ports,

92
03:11.110 --> 03:13.900 align:middle line:90%
which are untrusted from
a Dynamic ARP Inspection

93
03:13.900 --> 03:17.500 align:middle line:90%
perspective, all the other
ports will have their messages

94
03:17.500 --> 03:21.080 align:middle line:90%
checked for the correct
layer 3, layer 2 mapping.

95
03:21.080 --> 03:24.400 align:middle line:90%
So if we wanted to configure
interface 3/1 a trusted port,

96
03:24.400 --> 03:27.580 align:middle line:90%
we'd use this command right here
in interface config, IP, space,

97
03:27.580 --> 03:29.190 align:middle line:90%
ARP, space, inspect,
space, trust.

98
03:29.190 --> 03:33.040 align:middle line:90%
Press Enter, and no more
checking on interface 3/3.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:29.190 --> 03:33.040 align:middle line:90%
Press Enter, and no more
checking on interface 3/3.

99
03:33.040 --> 03:35.590 align:middle line:90%
And if we wanted to verify
that Dynamic ARP Inspection was

100
03:35.590 --> 03:39.190 align:middle line:90%
applied, we could use a command
show, IP, ARP, inspection,

101
03:39.190 --> 03:41.630 align:middle line:90%
VLAN, and then the VLAN
that we want to look at.

102
03:41.630 --> 03:43.840 align:middle line:90%
So in this video, we took
a look at the commands

103
03:43.840 --> 03:46.040 align:middle line:90%
to implement Dynamic
ARP Inspection.

104
03:46.040 --> 03:47.830 align:middle line:90%
And in the next
video, you and I get

105
03:47.830 --> 03:50.475 align:middle line:90%
to actually apply it and
verify it on a switch.

106
03:50.475 --> 03:52.100 align:middle line:90%
So I'll see you there
in just a moment.

107
03:52.100 --> 03:54.670 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

108
03:54.670 --> 03:57.990 align:middle line:90%
and I'd like to thank
you for viewing.