WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:03.170 align:middle line:90%
And while I have ya, are
you up for just one more

3
00:03.170 --> 00:06.340 align:middle line:90%
little tweak that we can add on
top of Dynamic ARP Inspection?

4
00:06.340 --> 00:08.665 align:middle line:84%
[MUSIC PLAYING]

5
00:08.665 --> 00:11.460 align:middle line:84%


6
00:11.460 --> 00:12.690 align:middle line:84%
Because it's pretty cool.

7
00:12.690 --> 00:14.940 align:middle line:90%
What happens by
default when DAI--

8
00:14.940 --> 00:17.190 align:middle line:90%
Dynamic ARP Inspection--
is installed or enabled,

9
00:17.190 --> 00:21.200 align:middle line:90%
is that it rate-limits ARP
traffic on a port to 15

10
00:21.200 --> 00:22.655 align:middle line:84%
ARP messages per second.

11
00:22.655 --> 00:24.030 align:middle line:90%
Now, that seems
like it should be

12
00:24.030 --> 00:25.482 align:middle line:90%
adequate for any
normal activity,

13
00:25.482 --> 00:27.940 align:middle line:90%
but as soon as it sees anything
malicious like a ping sweep

14
00:27.940 --> 00:29.315 align:middle line:90%
of the whole
network, and they're

15
00:29.315 --> 00:31.860 align:middle line:90%
trying to ARP for every single
IP address in that subnet,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.315 --> 00:31.860 align:middle line:90%
trying to ARP for every single
IP address in that subnet,

16
00:31.860 --> 00:34.080 align:middle line:90%
they could be cranking a
lot higher rates than that,

17
00:34.080 --> 00:36.760 align:middle line:90%
and Dynamic ARP
Inspection can stop that.

18
00:36.760 --> 00:38.772 align:middle line:90%
So the default rate
limiting is 15.

19
00:38.772 --> 00:40.980 align:middle line:90%
So I'd like to show you
where you can go to see that,

20
00:40.980 --> 00:42.540 align:middle line:84%
and also how you can change it.

21
00:42.540 --> 00:44.790 align:middle line:90%
So the way that we could see
the current rate limiting

22
00:44.790 --> 00:48.210 align:middle line:90%
for Dynamic ARP Inspections is
with the command show, IP, ARP,

23
00:48.210 --> 00:51.060 align:middle line:90%
inspection, and then
the keyword interfaces.

24
00:51.060 --> 00:52.680 align:middle line:84%
And press Enter.

25
00:52.680 --> 00:54.360 align:middle line:90%
And this will also
show whether or not

26
00:54.360 --> 00:56.415 align:middle line:90%
the interfaces are
trusted or not, so gig 3/3

27
00:56.415 --> 00:58.440 align:middle line:90%
we specifically
made as a trusted

28
00:58.440 --> 01:00.360 align:middle line:84%
port from a DAI perspective.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.440 --> 01:00.360 align:middle line:84%
port from a DAI perspective.

29
01:00.360 --> 01:03.090 align:middle line:90%
And then the rate packets
per second regarding all ARP

30
01:03.090 --> 01:06.750 align:middle line:90%
traffic on the untrusted
ports is 15 packets

31
01:06.750 --> 01:09.310 align:middle line:90%
per second by default. And
if we wanted to change that,

32
01:09.310 --> 01:10.110 align:middle line:84%
we could.

33
01:10.110 --> 01:15.960 align:middle line:90%
We'd go to interface gig 0/1
and do an IP ARP Inspection.

34
01:15.960 --> 01:21.058 align:middle line:90%
Question mark, limit, space,
rate, space, and then the rate

35
01:21.058 --> 01:21.850 align:middle line:84%
we want to give it.

36
01:21.850 --> 01:23.850 align:middle line:90%
So let's say we wanted
to, for some reason,

37
01:23.850 --> 01:25.890 align:middle line:90%
allow up to 100
packets per second

38
01:25.890 --> 01:28.830 align:middle line:90%
on that interface
regarding ARP traffic.

39
01:28.830 --> 01:32.010 align:middle line:90%
We could put that in, and
then use the upper arrow key
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:28.830 --> 01:32.010 align:middle line:90%
We could put that in, and
then use the upper arrow key

40
01:32.010 --> 01:36.690 align:middle line:90%
and do that command again, and
verify that it made the change.

41
01:36.690 --> 01:39.540 align:middle line:90%
Now, just for fun, if we wanted
to test that, what we could do

42
01:39.540 --> 01:42.270 align:middle line:90%
is go to our Kali
Linux box in the lab.

43
01:42.270 --> 01:46.580 align:middle line:90%
And here at the Kali Linux box,
we could just do a simple nmap.

44
01:46.580 --> 01:50.130 align:middle line:90%
So with nmap, we could
do a sweep of the network

45
01:50.130 --> 01:53.170 align:middle line:90%
and we could just try to find
all the devices that are there.

46
01:53.170 --> 01:55.230 align:middle line:90%
And if there is 254
possible addresses,

47
01:55.230 --> 01:58.223 align:middle line:90%
it's going to do ARPs
for 254 addresses,

48
01:58.223 --> 02:00.390 align:middle line:90%
and that's very likely going
to trigger even our 100
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:58.223 --> 02:00.390 align:middle line:90%
and that's very likely going
to trigger even our 100

49
02:00.390 --> 02:02.010 align:middle line:84%
threshold within a second.

50
02:02.010 --> 02:06.331 align:middle line:90%
So we'll put in 10.16.20.0
with a 24-bit mask.

51
02:06.331 --> 02:08.139 align:middle line:84%
(LAUGHS)

52
02:08.139 --> 02:10.830 align:middle line:90%
And I'll work with
my Num Locks there.

53
02:10.830 --> 02:11.610 align:middle line:84%
Darn it.

54
02:11.610 --> 02:12.110 align:middle line:84%
All right.

55
02:12.110 --> 02:13.350 align:middle line:84%
With my Num Locks adjusted--

56
02:13.350 --> 02:18.180 align:middle line:84%
10.16.20.0/24.

57
02:18.180 --> 02:18.780 align:middle line:84%
Great.

58
02:18.780 --> 02:20.470 align:middle line:90%
And we'll go into
ahead and do our scan.

59
02:20.470 --> 02:23.370 align:middle line:90%
Now, if we go back to
the console at DC-NUG,

60
02:23.370 --> 02:25.590 align:middle line:90%
if we violate that,
it'll let us know.

61
02:25.590 --> 02:27.410 align:middle line:84%
And sure enough, there it is.

62
02:27.410 --> 02:30.180 align:middle line:90%
103 packets received
in 630 milliseconds.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:27.410 --> 02:30.180 align:middle line:90%
103 packets received
in 630 milliseconds.

63
02:30.180 --> 02:32.660 align:middle line:90%
That port is now in
error disabled state.

64
02:32.660 --> 02:35.880 align:middle line:90%
So we do show, interface status,
error disabled, press Enter.

65
02:35.880 --> 02:37.470 align:middle line:84%
And there it is.

66
02:37.470 --> 02:39.110 align:middle line:90%
And to bring it
back up manually,

67
02:39.110 --> 02:43.830 align:middle line:90%
we'd go into configuration
mode, interface, gig 0/1,

68
02:43.830 --> 02:46.510 align:middle line:90%
we do a shut down
and a no shut down.

69
02:46.510 --> 02:48.960 align:middle line:84%
And that will bring it back up.

70
02:48.960 --> 02:51.450 align:middle line:90%
And while we're here, let's
go back to the Kali Linux box,

71
02:51.450 --> 02:54.610 align:middle line:90%
and let's do one more
fun little thing.

72
02:54.610 --> 02:55.770 align:middle line:84%
So here's the Linux box.

73
02:55.770 --> 02:59.840 align:middle line:84%
There's a tool called arpspoof.

74
02:59.840 --> 03:02.930 align:middle line:90%
If we press Enter, it's
pretty straightforward.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:59.840 --> 03:02.930 align:middle line:90%
If we press Enter, it's
pretty straightforward.

75
03:02.930 --> 03:04.780 align:middle line:90%
You type in arpspoof,
space, dash I,

76
03:04.780 --> 03:06.322 align:middle line:90%
the interface you
want to use-- we're

77
03:06.322 --> 03:08.590 align:middle line:90%
going to use
ethernet zero, space.

78
03:08.590 --> 03:11.440 align:middle line:90%
And then a quick way of doing
it is putting in the default

79
03:11.440 --> 03:12.610 align:middle line:84%
gateway's address.

80
03:12.610 --> 03:17.920 align:middle line:90%
This is mean, but 10.16.20.7
I believe is R3's address.

81
03:17.920 --> 03:19.970 align:middle line:84%
Let's go check that real quick.

82
03:19.970 --> 03:25.630 align:middle line:90%
So we'll go over to R3, do
a show IP interface brief.

83
03:25.630 --> 03:27.830 align:middle line:90%
Sure enough, for VLAN 30,
that's his IP address.

84
03:27.830 --> 03:32.150 align:middle line:90%
So if we go back to Kali Linux
box and we do this command.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:27.830 --> 03:32.150 align:middle line:90%
So if we go back to Kali Linux
box and we do this command.

85
03:32.150 --> 03:35.230 align:middle line:90%
What this is going to do is it's
going to send out a broadcast

86
03:35.230 --> 03:39.220 align:middle line:90%
response, an ARP response,
claiming that the layer 2

87
03:39.220 --> 03:41.860 align:middle line:84%
address of 10.16.20.7--

88
03:41.860 --> 03:45.010 align:middle line:90%
the default gateway--
is the layer 2 address

89
03:45.010 --> 03:47.915 align:middle line:90%
of ethernet zero on
this Kali Linux box.

90
03:47.915 --> 03:49.790 align:middle line:90%
And it's just going to
go on till we stop it.

91
03:49.790 --> 03:51.490 align:middle line:84%
So there you go.

92
03:51.490 --> 03:53.920 align:middle line:90%
So sending that out as a
broadcast over, and over,

93
03:53.920 --> 03:54.970 align:middle line:84%
and over again.

94
03:54.970 --> 03:57.880 align:middle line:90%
But great news everybody, we've
got Dynamic ARP Inspection

95
03:57.880 --> 03:58.550 align:middle line:84%
enabled.

96
03:58.550 --> 04:00.580 align:middle line:90%
So let's go take a look
at the switch console.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:58.550 --> 04:00.580 align:middle line:90%
So let's go take a look
at the switch console.

97
04:00.580 --> 04:04.960 align:middle line:90%
So back here at our switch,
that is just being denied again,

98
04:04.960 --> 04:06.170 align:middle line:84%
and again, and again.

99
04:06.170 --> 04:08.230 align:middle line:90%
Now, this is not putting
the port in an error

100
04:08.230 --> 04:09.970 align:middle line:90%
disabled state,
it's just denying

101
04:09.970 --> 04:12.240 align:middle line:90%
all of those ARP messages
that the Kali Linux

102
04:12.240 --> 04:13.930 align:middle line:84%
box is trying to pump in there.

103
04:13.930 --> 04:15.513 align:middle line:90%
And they're being
delayed because he's

104
04:15.513 --> 04:18.820 align:middle line:90%
lying about the layer 3, layer
2 mapping in his ARP messages

105
04:18.820 --> 04:21.860 align:middle line:90%
that he's sending as
broadcast into the network.

106
04:21.860 --> 04:23.770 align:middle line:90%
So we'll go back to
the Kali Linux box,

107
04:23.770 --> 04:27.120 align:middle line:90%
and we will do a
Control-C to stop that.

108
04:27.120 --> 04:32.020 align:middle line:90%
And then we go back to our Admin
PC and we'll do a show log,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:27.120 --> 04:32.020 align:middle line:90%
And then we go back to our Admin
PC and we'll do a show log,

109
04:32.020 --> 04:33.680 align:middle line:84%
and then hit Space a few times.

110
04:33.680 --> 04:37.180 align:middle line:90%
We can just ruminate
on all those denies

111
04:37.180 --> 04:40.720 align:middle line:90%
due to Dynamic ARP Inspection
doing a great job of protecting

112
04:40.720 --> 04:41.910 align:middle line:84%
the network.

113
04:41.910 --> 04:43.860 align:middle line:90%
And there's actually
just one more tip

114
04:43.860 --> 04:45.580 align:middle line:90%
that I'd like to
add regarding DIA--

115
04:45.580 --> 04:48.040 align:middle line:90%
Dynamic ARP Inspection to
make it even more secure.

116
04:48.040 --> 04:49.660 align:middle line:84%
Check this out.

117
04:49.660 --> 04:53.590 align:middle line:90%
On the switch, if we do
a show IP ARP inspection

118
04:53.590 --> 04:56.290 align:middle line:90%
for VLAN 30 and
press Enter, you'll

119
04:56.290 --> 04:58.600 align:middle line:84%
notice that it's enabled.

120
04:58.600 --> 04:59.830 align:middle line:84%
We've got our access list.

121
04:59.830 --> 05:01.480 align:middle line:90%
But these three
options right here--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:59.830 --> 05:01.480 align:middle line:90%
But these three
options right here--

122
05:01.480 --> 05:04.360 align:middle line:90%
Source Mac Validation,
Destination Mac Validation,

123
05:04.360 --> 05:08.420 align:middle line:90%
and IP Address Validation--
those are disabled by default.

124
05:08.420 --> 05:11.350 align:middle line:90%
So in addition to Dynamic
ARP Inspection's normal job

125
05:11.350 --> 05:14.290 align:middle line:90%
of looking at ARP responses,
and then if they're not valid,

126
05:14.290 --> 05:16.660 align:middle line:90%
IP to MAC mappings
dropping those,

127
05:16.660 --> 05:20.710 align:middle line:90%
it can also do these three
additional validation checks.

128
05:20.710 --> 05:22.540 align:middle line:90%
But they're not
enabled by default.

129
05:22.540 --> 05:25.510 align:middle line:90%
For source MAC validation,
Dynamic ARP Inspection is going

130
05:25.510 --> 05:27.610 align:middle line:90%
to check the MAC
address in a layer 2

131
05:27.610 --> 05:31.570 align:middle line:90%
header against the sender MAC
address in the ARP response.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:27.610 --> 05:31.570 align:middle line:90%
header against the sender MAC
address in the ARP response.

132
05:31.570 --> 05:34.120 align:middle line:90%
For destination MAC, it's going
to check the destination MAC

133
05:34.120 --> 05:37.030 align:middle line:90%
address in the ethernet layer
2 header against the target MAC

134
05:37.030 --> 05:39.490 align:middle line:90%
address that's part
of the ARP response.

135
05:39.490 --> 05:43.060 align:middle line:90%
And for IP, it's just looking
for unexpected bogus types

136
05:43.060 --> 05:45.640 align:middle line:90%
of IP information
that might be included

137
05:45.640 --> 05:47.800 align:middle line:84%
as part of an ARP response.

138
05:47.800 --> 05:49.438 align:middle line:90%
And to enable them
it's a one-liner.

139
05:49.438 --> 05:50.980 align:middle line:90%
So if we go into
configuration mode--

140
05:50.980 --> 05:53.990 align:middle line:84%
IP, ARP, inspection.

141
05:53.990 --> 05:55.983 align:middle line:90%
We said we had the
command to validate,

142
05:55.983 --> 05:57.400 align:middle line:90%
and then we add
the option that we

143
05:57.400 --> 06:01.090 align:middle line:90%
want to validate-- destination
Mac address, IP information,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
05:57.400 --> 06:01.090 align:middle line:90%
want to validate-- destination
Mac address, IP information,

144
06:01.090 --> 06:02.140 align:middle line:84%
and source MAC address.

145
06:02.140 --> 06:03.480 align:middle line:84%
Just like that.

146
06:03.480 --> 06:04.620 align:middle line:84%
And then we press Enter.

147
06:04.620 --> 06:07.120 align:middle line:90%
Then, if we do it up arrow key
again for that same command--

148
06:07.120 --> 06:09.650 align:middle line:90%
show IP ARP inspection
for VLAN 30,

149
06:09.650 --> 06:11.590 align:middle line:90%
now those three
additional checks

150
06:11.590 --> 06:14.430 align:middle line:90%
are being done
regarding ARP messages.

151
06:14.430 --> 06:16.690 align:middle line:90%
So as a result of our time
together in these videos

152
06:16.690 --> 06:18.148 align:middle line:90%
and labs, we've
had the opportunity

153
06:18.148 --> 06:20.590 align:middle line:90%
to configure ARP inspection
a couple of times,

154
06:20.590 --> 06:23.740 align:middle line:90%
configure ARP access lists
as additional information

155
06:23.740 --> 06:26.890 align:middle line:90%
for Dynamic ARP Inspection
to map out the layer 3

156
06:26.890 --> 06:28.900 align:middle line:90%
and layer 2 mappings
in addition to what's

157
06:28.900 --> 06:30.820 align:middle line:84%
in the DHCP snooping table.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
06:28.900 --> 06:30.820 align:middle line:84%
in the DHCP snooping table.

158
06:30.820 --> 06:33.290 align:middle line:90%
We've also a chance
to verify the results.

159
06:33.290 --> 06:35.920 align:middle line:90%
So I've enjoyed having you in
this journey through the world

160
06:35.920 --> 06:37.990 align:middle line:90%
of Dynamic ARP Inspection,
and I look forward

161
06:37.990 --> 06:39.740 align:middle line:84%
to seeing you in the next video.

162
06:39.740 --> 06:42.160 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

163
06:42.160 --> 06:45.360 align:middle line:90%
and I'd like to thank
you for viewing.