WEBVTT

1
00:00.000 --> 00:00.525 align:middle line:84%


2
00:00.525 --> 00:01.900 align:middle line:90%
In the previous
video and lab, we

3
00:01.900 --> 00:05.020 align:middle line:90%
enabled Dynamic ARP
inspection on VLAN 30.

4
00:05.020 --> 00:07.670 align:middle line:90%
We also set up port
3/3 as a trusted port

5
00:07.670 --> 00:10.480 align:middle line:90%
so any ARP messages coming in
on that port from the router

6
00:10.480 --> 00:12.970 align:middle line:90%
or anybody else off that port
aren't going to be checked.

7
00:12.970 --> 00:15.940 align:middle line:90%
However, we ran into a
little bit of a problem, that

8
00:15.940 --> 00:18.970 align:middle line:90%
is on gig 0/1, there's
some ARP messages that

9
00:18.970 --> 00:21.940 align:middle line:90%
are being dropped simply
because they're being sourced

10
00:21.940 --> 00:25.300 align:middle line:90%
from entities or devices that
have not been dynamically

11
00:25.300 --> 00:28.030 align:middle line:90%
learned, and they're not part
of the DHCP snooping table.

12
00:28.030 --> 00:31.270 align:middle line:90%
So to solve that, we're going
to create an ARP access control
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.030 --> 00:31.270 align:middle line:90%
So to solve that, we're going
to create an ARP access control

13
00:31.270 --> 00:31.840 align:middle line:84%
list.

14
00:31.840 --> 00:34.750 align:middle line:90%
This ARP list is going to have
an IP address and a layer 2

15
00:34.750 --> 00:35.458 align:middle line:84%
address.

16
00:35.458 --> 00:37.000 align:middle line:90%
And then we hand
that over to Dynamic

17
00:37.000 --> 00:39.190 align:middle line:90%
ARP inspection and
say, guess what?

18
00:39.190 --> 00:42.820 align:middle line:90%
In addition to the DHCP
bindings that you dynamically

19
00:42.820 --> 00:45.910 align:middle line:90%
learn for DHCP clients,
also check this list.

20
00:45.910 --> 00:48.130 align:middle line:90%
If they match up
there, they're OK.

21
00:48.130 --> 00:50.290 align:middle line:90%
So let's take a peek
at our topology again.

22
00:50.290 --> 00:52.240 align:middle line:90%
And then I'll walk
you through the syntax

23
00:52.240 --> 00:56.060 align:middle line:90%
for creating and enabling
an ARP access list.

24
00:56.060 --> 00:57.820 align:middle line:90%
So here's our
topology once again.

25
00:57.820 --> 01:00.490 align:middle line:90%
And I've reset the lab, which
will give us an opportunity
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:57.820 --> 01:00.490 align:middle line:90%
And I've reset the lab, which
will give us an opportunity

26
01:00.490 --> 01:03.430 align:middle line:90%
to implement ARP inspection
again for VLAN 30.

27
01:03.430 --> 01:06.970 align:middle line:90%
We can also set up port 3/3
as a trusted port again.

28
01:06.970 --> 01:10.060 align:middle line:90%
And then when we start getting
additional ARP messages that

29
01:10.060 --> 01:12.610 align:middle line:90%
are being denied
off gig 0/1, I'll

30
01:12.610 --> 01:15.760 align:middle line:90%
walk you through step-by-step of
creating an ARP access control

31
01:15.760 --> 01:18.400 align:middle line:90%
list that'll
identify the layer 3

32
01:18.400 --> 01:20.720 align:middle line:90%
address and the corresponding
layer 2 address.

33
01:20.720 --> 01:23.770 align:middle line:90%
And as a result, the switch
can then verify ARP messages

34
01:23.770 --> 01:27.640 align:middle line:90%
from those devices as well, even
though those devices were not

35
01:27.640 --> 01:30.190 align:middle line:90%
DHCP clients and they
weren't dynamically learned
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:27.640 --> 01:30.190 align:middle line:90%
DHCP clients and they
weren't dynamically learned

36
01:30.190 --> 01:32.170 align:middle line:84%
through DHCP snooping.

37
01:32.170 --> 01:34.660 align:middle line:90%
So to confirm, let's
to a show ip dhcp

38
01:34.660 --> 01:37.090 align:middle line:90%
snooping and binding
just to verify

39
01:37.090 --> 01:38.960 align:middle line:84%
what the switch can work with.

40
01:38.960 --> 01:41.470 align:middle line:90%
So for VLAN 30, it
knows about one mapping.

41
01:41.470 --> 01:44.410 align:middle line:90%
And that's this layer 3 address
to this layer 2 address,

42
01:44.410 --> 01:45.410 align:middle line:84%
and that's it.

43
01:45.410 --> 01:47.420 align:middle line:90%
It doesn't know
about anything else.

44
01:47.420 --> 01:49.570 align:middle line:90%
So we're going to re enable
Dynamic ARP inspection

45
01:49.570 --> 01:50.780 align:middle line:84%
because I've reset the lab.

46
01:50.780 --> 01:53.710 align:middle line:90%
So we're going to go
to interface gig 3/3,

47
01:53.710 --> 01:57.710 align:middle line:90%
and we'll do an
ip arp inspection.

48
01:57.710 --> 01:59.320 align:middle line:84%
And we'll say trust that port.

49
01:59.320 --> 02:00.130 align:middle line:84%
Great.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:59.320 --> 02:00.130 align:middle line:84%
Great.

50
02:00.130 --> 02:01.720 align:middle line:84%
Exit out of interface config.

51
02:01.720 --> 02:06.370 align:middle line:90%
And then we'll do an ip
arp inspection for VLAN 30.

52
02:06.370 --> 02:07.510 align:middle line:84%
And that will enable it.

53
02:07.510 --> 02:09.970 align:middle line:90%
And because I still have those
talkers hanging off of gig

54
02:09.970 --> 02:13.030 align:middle line:90%
0/1 that were not
DHCP clients and not

55
02:13.030 --> 02:15.495 align:middle line:90%
part of the DHCP stooping
binding information,

56
02:15.495 --> 02:17.370 align:middle line:90%
we're going to see those
messages pop up here

57
02:17.370 --> 02:18.400 align:middle line:84%
in just a few moments.

58
02:18.400 --> 02:19.900 align:middle line:90%
So while that's
cooking, while we're

59
02:19.900 --> 02:22.480 align:middle line:90%
waiting for those messages, we
can create an ARP access list.

60
02:22.480 --> 02:23.500 align:middle line:84%
And it goes like this--

61
02:23.500 --> 02:25.785 align:middle line:84%
arp space access list.

62
02:25.785 --> 02:26.910 align:middle line:84%
And then we give it a name.

63
02:26.910 --> 02:29.560 align:middle line:90%
Let's call it OUR
uppercase LIST.

64
02:29.560 --> 02:30.700 align:middle line:84%
Just like that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:29.560 --> 02:30.700 align:middle line:84%
Just like that.

65
02:30.700 --> 02:32.320 align:middle line:90%
And in this ARP
access list, it's

66
02:32.320 --> 02:34.690 align:middle line:90%
asking us for permit
or deny statements

67
02:34.690 --> 02:38.830 align:middle line:90%
regarding combinations of Mac
addresses and IP addresses.

68
02:38.830 --> 02:43.500 align:middle line:90%
So for example, this one right
here, this guy at 10.1.0.111

69
02:43.500 --> 02:45.300 align:middle line:84%
with his layer 2 address.

70
02:45.300 --> 02:47.770 align:middle line:90%
This switch just doesn't
know about that mapping.

71
02:47.770 --> 02:50.508 align:middle line:90%
So it can't verify that
it's a valid ARP message.

72
02:50.508 --> 02:52.800 align:middle line:90%
So if we wanted to add this
to our access control list,

73
02:52.800 --> 02:55.950 align:middle line:84%
we'd say permit ip host.

74
02:55.950 --> 02:58.457 align:middle line:90%
And then we'd put in the
IP address of this host

75
02:58.457 --> 02:59.790 align:middle line:84%
where we want the mapping to be.

76
02:59.790 --> 03:03.030 align:middle line:90%
So I'm going to
Copy-Paste 10.1.0.111
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:59.790 --> 03:03.030 align:middle line:90%
So I'm going to
Copy-Paste 10.1.0.111

77
03:03.030 --> 03:05.980 align:middle line:84%
space we'll type in mac space.

78
03:05.980 --> 03:07.280 align:middle line:84%
And then we have some options.

79
03:07.280 --> 03:09.030 align:middle line:90%
And if we want to
specify the Mac address,

80
03:09.030 --> 03:12.900 align:middle line:90%
we'd use the keyword host
space and then the 48 bits

81
03:12.900 --> 03:14.910 align:middle line:90%
here, which is the 12
hexadecimal characters.

82
03:14.910 --> 03:17.400 align:middle line:90%
I'm going to Copy-Paste
that in, press Enter.

83
03:17.400 --> 03:19.200 align:middle line:90%
And now that's one
of our two entries.

84
03:19.200 --> 03:22.320 align:middle line:90%
Now 111 was one of
our offenders here.

85
03:22.320 --> 03:25.690 align:middle line:90%
If I scroll up a little bit,
I think there was another one.

86
03:25.690 --> 03:27.220 align:middle line:90%
But until it comes
up on the screen,

87
03:27.220 --> 03:28.810 align:middle line:84%
I won't see what that is.

88
03:28.810 --> 03:31.920 align:middle line:90%
So let me just show you how
to apply this access control
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:28.810 --> 03:31.920 align:middle line:90%
So let me just show you how
to apply this access control

89
03:31.920 --> 03:34.260 align:middle line:84%
list to ARP inspection.

90
03:34.260 --> 03:36.510 align:middle line:90%
And the way we do that,
we'll exit out of access list

91
03:36.510 --> 03:37.920 align:middle line:84%
configuration mode.

92
03:37.920 --> 03:42.330 align:middle line:90%
And we use the command ip arp
inspection filter and then

93
03:42.330 --> 03:43.300 align:middle line:84%
the name of the filter.

94
03:43.300 --> 03:45.863 align:middle line:90%
So the name of the
filter, if it's--

95
03:45.863 --> 03:46.530 align:middle line:84%
what we call it?

96
03:46.530 --> 03:47.620 align:middle line:84%
Let me scroll up a little bit.

97
03:47.620 --> 03:48.120 align:middle line:84%
Here we go.

98
03:48.120 --> 03:49.720 align:middle line:84%
We called it OUR-LIST.

99
03:49.720 --> 03:52.440 align:middle line:90%
So just going to
Copy-Paste that space

100
03:52.440 --> 03:54.770 align:middle line:90%
and then where we want
to apply it-- vlan 30.

101
03:54.770 --> 03:57.030 align:middle line:84%
Press Enter.

102
03:57.030 --> 03:58.800 align:middle line:90%
Oh, and there's our
other guy right there.

103
03:58.800 --> 04:00.130 align:middle line:84%
It's 120.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:58.800 --> 04:00.130 align:middle line:84%
It's 120.

104
04:00.130 --> 04:02.387 align:middle line:84%
So the 111 is going to drop off.

105
04:02.387 --> 04:04.470 align:middle line:90%
Those messages are going
to stop because we're now

106
04:04.470 --> 04:05.400 align:middle line:84%
able to match on him.

107
04:05.400 --> 04:07.710 align:middle line:90%
Our DAI is-- Dynamic
ARP inspection.

108
04:07.710 --> 04:09.490 align:middle line:90%
But let's add another
entry for 120.

109
04:09.490 --> 04:11.940 align:middle line:90%
So I'm going to hit the
up arrow key a few times.

110
04:11.940 --> 04:14.850 align:middle line:90%
And we'll go back into our
access list configuration.

111
04:14.850 --> 04:18.240 align:middle line:90%
And we'll say permit
ip host space.

112
04:18.240 --> 04:21.601 align:middle line:84%
And we'll add 10.1.0.120.

113
04:21.601 --> 04:23.130 align:middle line:84%
We'll Copy-Paste that.

114
04:23.130 --> 04:25.890 align:middle line:90%
And then we use the keyword
mac and the keyword host.

115
04:25.890 --> 04:30.780 align:middle line:90%
And then we'll put in his
layer 2 address right there.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:25.890 --> 04:30.780 align:middle line:90%
And then we'll put in his
layer 2 address right there.

116
04:30.780 --> 04:34.530 align:middle line:90%
And with that done, that
should settle him down

117
04:34.530 --> 04:36.060 align:middle line:90%
because he's now
able to be matched.

118
04:36.060 --> 04:38.100 align:middle line:90%
So Dynamic ARP
inspection is going

119
04:38.100 --> 04:41.730 align:middle line:90%
to two places for a confirmation
of what the correct layer 3

120
04:41.730 --> 04:43.260 align:middle line:84%
and layer 2 mapping should be.

121
04:43.260 --> 04:45.900 align:middle line:90%
It's going to use the DHCP
snooping binding table

122
04:45.900 --> 04:48.660 align:middle line:84%
if we just show ip dhcp snoop.

123
04:48.660 --> 04:51.070 align:middle line:90%
And binding, it's
going to use this.

124
04:51.070 --> 04:53.760 align:middle line:90%
So this is how it knows
about this bad boy that's

125
04:53.760 --> 04:54.910 align:middle line:84%
highlighted there.

126
04:54.910 --> 04:58.590 align:middle line:90%
It's also going to use the show
arp access-list that we just

127
04:58.590 --> 05:00.780 align:middle line:90%
created to identify
that mapping.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
04:58.590 --> 05:00.780 align:middle line:90%
created to identify
that mapping.

128
05:00.780 --> 05:04.170 align:middle line:90%
And we can verify that
with a show ip arp

129
05:04.170 --> 05:07.140 align:middle line:84%
inspection for vlan 30.

130
05:07.140 --> 05:08.620 align:middle line:84%
And that will show us as well.

131
05:08.620 --> 05:11.130 align:middle line:90%
So ARP inspection is
enabled for the VLAN.

132
05:11.130 --> 05:14.640 align:middle line:90%
And there's our list that's
also being used as a check

133
05:14.640 --> 05:17.250 align:middle line:90%
to see whether or not the
layer 3 and layer 2 mappings

134
05:17.250 --> 05:19.317 align:middle line:90%
are correct regarding
ARP messages.

135
05:19.317 --> 05:20.400 align:middle line:84%
And then one more command.

136
05:20.400 --> 05:25.070 align:middle line:90%
We just show ip arp
inspection statistics.

137
05:25.070 --> 05:26.040 align:middle line:84%
Press Enter.

138
05:26.040 --> 05:27.800 align:middle line:90%
This is also a
great thing to do.

139
05:27.800 --> 05:29.550 align:middle line:90%
So if we take a look
at the permits here--

140
05:29.550 --> 05:34.340 align:middle line:90%
ACL Permits, 46, we've had 46
matches on that access control
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
05:29.550 --> 05:34.340 align:middle line:90%
ACL Permits, 46, we've had 46
matches on that access control

141
05:34.340 --> 05:36.683 align:middle line:90%
list that we just
set up that are now

142
05:36.683 --> 05:38.850 align:middle line:90%
being allowed-- those ARP
messages-- because they're

143
05:38.850 --> 05:41.592 align:middle line:84%
being permitted in the ARP ACL.

144
05:41.592 --> 05:43.800 align:middle line:90%
And just for grins, to move
the counters a little bit

145
05:43.800 --> 05:46.620 align:middle line:90%
from something other
than matching on the ACL,

146
05:46.620 --> 05:48.900 align:middle line:90%
let's go ahead and go
to our Kali Linux box.

147
05:48.900 --> 05:52.500 align:middle line:90%
This is a computer sitting
off of gig 0/1 as well.

148
05:52.500 --> 05:58.110 align:middle line:90%
If we do an config on this
guy, he's at 10.16.20.102.

149
05:58.110 --> 06:01.340 align:middle line:90%
And his Mac address
ends in 77:77:01.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
05:58.110 --> 06:01.340 align:middle line:90%
And his Mac address
ends in 77:77:01.

150
06:01.340 --> 06:04.120 align:middle line:90%
Yeah, that's the guy that
was in the snooping table.

151
06:04.120 --> 06:05.080 align:middle line:84%
That's great.

152
06:05.080 --> 06:08.552 align:middle line:84%
So if we do a ping to 10.16.20--

153
06:08.552 --> 06:09.510 align:middle line:84%
what network are we on?

154
06:09.510 --> 06:11.150 align:middle line:84%
We're on the 20 subnet.

155
06:11.150 --> 06:13.948 align:middle line:90%
Lets just go ahead and hit
our default gateway at dot 7.

156
06:13.948 --> 06:15.990 align:middle line:90%
If we didn't already have
that information cached

157
06:15.990 --> 06:18.510 align:middle line:90%
as far as the layer 2 address,
that would have cached it.

158
06:18.510 --> 06:22.980 align:middle line:90%
But if we go back to DCNUG,
and we hit the up arrow key,

159
06:22.980 --> 06:25.930 align:middle line:90%
for show ip arp
inspection statistics,

160
06:25.930 --> 06:29.007 align:middle line:90%
you'll notice that we have
the ACL that permitted 99.

161
06:29.007 --> 06:30.090 align:middle line:84%
But we have forwarded 101.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

161
06:29.007 --> 06:30.090 align:middle line:84%
But we have forwarded 101.

162
06:30.090 --> 06:32.640 align:middle line:90%
And that's because we had at
least one from that client--

163
06:32.640 --> 06:34.320 align:middle line:84%
the Kali Linux box--

164
06:34.320 --> 06:35.370 align:middle line:84%
that was also forwarded.

165
06:35.370 --> 06:37.570 align:middle line:90%
But he was in the
DHCP snooping table.

166
06:37.570 --> 06:39.240 align:middle line:84%
So that was allowed.

167
06:39.240 --> 06:41.040 align:middle line:90%
I hope this has been
informative for you.

168
06:41.040 --> 06:44.270 align:middle line:90%
And I'd like to thank
you for viewing.