WEBVTT

1
00:00.000 --> 00:00.880 align:middle line:84%


2
00:00.880 --> 00:03.250 align:middle line:90%
It is pretty fun
to learn new things

3
00:03.250 --> 00:05.470 align:middle line:90%
and improve our
knowledge and our skills.

4
00:05.470 --> 00:07.270 align:middle line:90%
And sometimes the word
gets out, and that's

5
00:07.270 --> 00:09.187 align:middle line:90%
what's happening today
with you and I as well,

6
00:09.187 --> 00:10.580 align:middle line:90%
regarding Dynamic
ARP Inspection.

7
00:10.580 --> 00:13.750 align:middle line:90%
Bob has heard that we've been
practicing and working with it,

8
00:13.750 --> 00:16.990 align:middle line:90%
and he has asked you and I once
again to come to his office,

9
00:16.990 --> 00:20.110 align:middle line:90%
and help them implement Dynamic
ARP Inspection to better

10
00:20.110 --> 00:21.440 align:middle line:84%
protect their network.

11
00:21.440 --> 00:22.940 align:middle line:90%
So let's take a
look at Bob's plan,

12
00:22.940 --> 00:25.070 align:middle line:84%
and then we'll go to the lab.

13
00:25.070 --> 00:27.370 align:middle line:90%
So we meet with Bob, and
this is what he tells us,

14
00:27.370 --> 00:29.620 align:middle line:90%
that we're going to be
doing some work in Florida,

15
00:29.620 --> 00:33.430 align:middle line:90%
and they want to set up Dynamic
ARP Inspection on VLAN 40
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.620 --> 00:33.430 align:middle line:90%
and they want to set up Dynamic
ARP Inspection on VLAN 40

16
00:33.430 --> 00:34.450 align:middle line:84%
in Florida.

17
00:34.450 --> 00:35.950 align:middle line:84%
So this port right here--

18
00:35.950 --> 00:38.830 align:middle line:90%
gig 0/2 coming off
the Florida switch

19
00:38.830 --> 00:40.180 align:middle line:84%
is already assigned to VLAN 40.

20
00:40.180 --> 00:42.160 align:middle line:90%
But what we would
want to do is we

21
00:42.160 --> 00:45.220 align:middle line:90%
would want to verify,
once we get there,

22
00:45.220 --> 00:46.270 align:middle line:84%
that that's the case.

23
00:46.270 --> 00:47.750 align:middle line:90%
So don't take too
much for granted.

24
00:47.750 --> 00:50.590 align:middle line:90%
We'll want to verify that
this port is in VLAN 40.

25
00:50.590 --> 00:52.060 align:middle line:90%
And then Bob also
wants us to trust

26
00:52.060 --> 00:55.378 align:middle line:90%
port 3/3, which is the port
that leads off to the router.

27
00:55.378 --> 00:57.170 align:middle line:90%
And one of the reasons
for that, of course,

28
00:57.170 --> 01:01.240 align:middle line:90%
is because this IP address
on gig 1/3 on the router,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:57.170 --> 01:01.240 align:middle line:90%
is because this IP address
on gig 1/3 on the router,

29
01:01.240 --> 01:04.480 align:middle line:90%
was not dynamically
assigned via DHCP.

30
01:04.480 --> 01:06.820 align:middle line:90%
So this is our task
on the Florida switch,

31
01:06.820 --> 01:10.810 align:middle line:90%
is to enable DAI on
VLAN 40, trust port 3/3,

32
01:10.810 --> 01:12.760 align:middle line:90%
and then verify that
it's is working.

33
01:12.760 --> 01:15.640 align:middle line:90%
And we have PC-2, which
is a virtual PC, which

34
01:15.640 --> 01:19.250 align:middle line:90%
is sitting off of that port
that we can use for testing.

35
01:19.250 --> 01:20.980 align:middle line:90%
So if you're logged
on currently to a PC,

36
01:20.980 --> 01:23.313 align:middle line:90%
click on the link for the
virtual lab, bring the lab up,

37
01:23.313 --> 01:25.960 align:middle line:90%
and together we'll implement
this solution for Bob

38
01:25.960 --> 01:28.575 align:middle line:90%
in the Florida portion
of his network.

39
01:28.575 --> 01:29.950 align:middle line:90%
All right, so here
at the switch,

40
01:29.950 --> 01:33.490 align:middle line:90%
let's see some verification
first to show VLAN brief,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.950 --> 01:33.490 align:middle line:90%
let's see some verification
first to show VLAN brief,

41
01:33.490 --> 01:35.740 align:middle line:90%
just to make sure
that we have VLAN 40.

42
01:35.740 --> 01:36.920 align:middle line:84%
And we do.

43
01:36.920 --> 01:37.420 align:middle line:84%
Great.

44
01:37.420 --> 01:41.260 align:middle line:90%
There's VLAN 40, and gig 0/2
is an access port in that VLAN.

45
01:41.260 --> 01:42.240 align:middle line:84%
That's great.

46
01:42.240 --> 01:44.410 align:middle line:90%
Let's also a show
CDP neighbors just

47
01:44.410 --> 01:47.110 align:middle line:90%
to verify that router
3 really is hanging off

48
01:47.110 --> 01:48.430 align:middle line:84%
gig 3/3, which it is.

49
01:48.430 --> 01:49.680 align:middle line:84%
Fantastic.

50
01:49.680 --> 01:51.682 align:middle line:90%
And let's set that up
as a trusted DAI port.

51
01:51.682 --> 01:53.890 align:middle line:90%
So to do that, we're going
to interface configuration

52
01:53.890 --> 01:56.840 align:middle line:90%
mode for interface
gig 3/3, and we'll

53
01:56.840 --> 02:01.470 align:middle line:90%
do IP ARP inspection, and the
keyword trust, and press Enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:56.840 --> 02:01.470 align:middle line:90%
do IP ARP inspection, and the
keyword trust, and press Enter.

54
02:01.470 --> 02:02.390 align:middle line:84%
That part is done.

55
02:02.390 --> 02:04.210 align:middle line:90%
Click Exit, and
that we'll enable

56
02:04.210 --> 02:07.150 align:middle line:84%
IPR inspection for VLAN 40.

57
02:07.150 --> 02:11.080 align:middle line:90%
So to do that, we'll do
IP, ARP, inspection, VLAN

58
02:11.080 --> 02:13.900 align:middle line:84%
40, press Enter.

59
02:13.900 --> 02:16.870 align:middle line:90%
Then we'll do a show ARP
inspection for VLAN 40,

60
02:16.870 --> 02:18.310 align:middle line:84%
just to make sure it's enabled.

61
02:18.310 --> 02:18.910 align:middle line:84%
There we go.

62
02:18.910 --> 02:21.080 align:middle line:84%
So it's enabled and it's active.

63
02:21.080 --> 02:22.820 align:middle line:84%
That's fantastic.

64
02:22.820 --> 02:25.090 align:middle line:90%
And if we looked at the
DHCP snooping bindings,

65
02:25.090 --> 02:30.040 align:middle line:90%
we could do a show IP, DHCP
snooping, with the binding.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
02:25.090 --> 02:30.040 align:middle line:90%
we could do a show IP, DHCP
snooping, with the binding.

66
02:30.040 --> 02:32.800 align:middle line:90%
And so, we have in VLAN 40,
this guy right here ending

67
02:32.800 --> 02:37.070 align:middle line:90%
in 66:68:00 with the
IP address of 101.

68
02:37.070 --> 02:40.060 align:middle line:84%
And that is the Florida PC-2.

69
02:40.060 --> 02:42.030 align:middle line:90%
And there's a tab for
that one right here.

70
02:42.030 --> 02:45.010 align:middle line:90%
So if we go to this
PC we do a show IP,

71
02:45.010 --> 02:46.417 align:middle line:84%
this is a virtual machine.

72
02:46.417 --> 02:47.500 align:middle line:84%
So here's the IP address--

73
02:47.500 --> 02:49.270 align:middle line:84%
10.16.22.101.

74
02:49.270 --> 02:52.270 align:middle line:84%
And if you did a ping to--

75
02:52.270 --> 02:55.740 align:middle line:84%
let's go to 10.16.22.7--

76
02:55.740 --> 02:57.010 align:middle line:84%
that's his default gateway.

77
02:57.010 --> 02:58.120 align:middle line:84%
And that works.

78
02:58.120 --> 02:58.900 align:middle line:84%
Great.

79
02:58.900 --> 03:00.310 align:middle line:90%
And one way we
could test this is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:58.900 --> 03:00.310 align:middle line:90%
And one way we
could test this is

80
03:00.310 --> 03:01.860 align:middle line:84%
this, what if we took this PC--

81
03:01.860 --> 03:04.210 align:middle line:90%
PC-2-- and we gave it
a different IP address

82
03:04.210 --> 03:05.680 align:middle line:84%
that was static.

83
03:05.680 --> 03:08.080 align:middle line:90%
If we gave it a static
address that was different,

84
03:08.080 --> 03:10.600 align:middle line:90%
than the switch wouldn't have
a layer 3, layer 2 mapping.

85
03:10.600 --> 03:12.210 align:middle line:90%
And then if it
tried to do an ARP,

86
03:12.210 --> 03:14.390 align:middle line:90%
the switch would not
be able to verify it.

87
03:14.390 --> 03:16.640 align:middle line:90%
And as a result, the switch
should drop it right there

88
03:16.640 --> 03:17.650 align:middle line:84%
in port gig 0/2.

89
03:17.650 --> 03:18.860 align:middle line:84%
So let's do that next.

90
03:18.860 --> 03:20.650 align:middle line:90%
So we'll go back
to our admin PC,

91
03:20.650 --> 03:22.440 align:middle line:90%
and we'll go to the
tab for the Florida

92
03:22.440 --> 03:24.190 align:middle line:90%
PC-2, that virtual
machine, and let's just

93
03:24.190 --> 03:26.110 align:middle line:84%
give it a different IP address.

94
03:26.110 --> 03:28.060 align:middle line:84%
So currently, it's got 101.

95
03:28.060 --> 03:29.490 align:middle line:84%
Let's give it 200.

96
03:29.490 --> 03:35.590 align:middle line:90%
So IP on this virtual machine,
the syntax is 10.16.22.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:29.490 --> 03:35.590 align:middle line:90%
So IP on this virtual machine,
the syntax is 10.16.22.

97
03:35.590 --> 03:36.942 align:middle line:84%
And let's go ahead and use 200.

98
03:36.942 --> 03:38.400 align:middle line:90%
And you can throw
on a mask or not.

99
03:38.400 --> 03:39.545 align:middle line:90%
It doesn't really matter,
because we're only

100
03:39.545 --> 03:41.470 align:middle line:84%
going to use this temporarily.

101
03:41.470 --> 03:43.360 align:middle line:90%
So it believes
it's IP address is

102
03:43.360 --> 03:46.880 align:middle line:84%
10.16.22.20 with a 24-bit mask.

103
03:46.880 --> 03:50.580 align:middle line:90%
And now, if we
try to do a ping--

104
03:50.580 --> 03:52.860 align:middle line:90%
let's see if can use
the up key a few times--

105
03:52.860 --> 03:55.726 align:middle line:84%
ping 10.16.22.7.

106
03:55.726 --> 03:57.190 align:middle line:84%
Hmm.

107
03:57.190 --> 03:58.030 align:middle line:84%
That's not so happy.

108
03:58.030 --> 03:58.775 align:middle line:84%
Why is that?

109
03:58.775 --> 04:01.150 align:middle line:90%
Well, these virtual machines
have a very short ARP cache,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
03:58.775 --> 04:01.150 align:middle line:90%
Well, these virtual machines
have a very short ARP cache,

110
04:01.150 --> 04:04.900 align:middle line:90%
so when we did a ping for
10.16.22.7, in the background

111
04:04.900 --> 04:06.040 align:middle line:84%
there was an ARP request.

112
04:06.040 --> 04:08.320 align:middle line:90%
But the switch
couldn't verify it,

113
04:08.320 --> 04:11.110 align:middle line:90%
because there's no entry
in the DHCP snooping table.

114
04:11.110 --> 04:12.610 align:middle line:84%
There's no ARP ACL.

115
04:12.610 --> 04:14.230 align:middle line:90%
So when we go back
to the switch,

116
04:14.230 --> 04:16.410 align:middle line:90%
sure enough, all of
those ARPs were not

117
04:16.410 --> 04:18.160 align:middle line:90%
allowed because they
couldn't be verified.

118
04:18.160 --> 04:20.170 align:middle line:90%
The layer 3 to layer
2 mapping couldn't

119
04:20.170 --> 04:22.790 align:middle line:90%
be verified by the switch
with Dynamic ARP Inspection,

120
04:22.790 --> 04:24.040 align:middle line:84%
so it dropped them.

121
04:24.040 --> 04:26.740 align:middle line:90%
If we went back to our client
and we got an IP address again,

122
04:26.740 --> 04:31.143 align:middle line:90%
via DHCP, with an IP
DHCP, press Enter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:26.740 --> 04:31.143 align:middle line:90%
via DHCP, with an IP
DHCP, press Enter.

123
04:31.143 --> 04:32.560 align:middle line:90%
And it's going to
visually show us

124
04:32.560 --> 04:36.610 align:middle line:90%
going through the discover
offer request process.

125
04:36.610 --> 04:38.770 align:middle line:90%
If we went back to
the switch, that entry

126
04:38.770 --> 04:40.390 align:middle line:90%
is going to be the
snooping table.

127
04:40.390 --> 04:44.310 align:middle line:90%
So we do a show, IP,
DHCP, snooping, binding.

128
04:44.310 --> 04:46.400 align:middle line:90%
There's the IP address
that we've just got.

129
04:46.400 --> 04:48.030 align:middle line:90%
And now we go back
to the client,

130
04:48.030 --> 04:51.070 align:middle line:90%
and we hit the up key a couple
times, and do a ping again.

131
04:51.070 --> 04:53.860 align:middle line:90%
It's going to fly, because
the ARP is congruent now

132
04:53.860 --> 04:55.403 align:middle line:84%
with what the switch can verify.

133
04:55.403 --> 04:57.820 align:middle line:90%
So let's do a quick check and
make sure we got everything.

134
04:57.820 --> 05:00.250 align:middle line:90%
We enabled Dynamic ARP
inspection on VLAN 40,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
04:57.820 --> 05:00.250 align:middle line:90%
We enabled Dynamic ARP
inspection on VLAN 40,

135
05:00.250 --> 05:02.530 align:middle line:90%
we trusted this port
right here, and we

136
05:02.530 --> 05:04.900 align:middle line:90%
verified it's working by
statically configuring an IP

137
05:04.900 --> 05:05.590 align:middle line:84%
address.

138
05:05.590 --> 05:07.090 align:middle line:90%
And then, when it
sent an ARP it was

139
05:07.090 --> 05:08.970 align:middle line:90%
blocked, because the
switch couldn't verify it,

140
05:08.970 --> 05:10.320 align:middle line:84%
and that verifies it is working.

141
05:10.320 --> 05:12.925 align:middle line:90%
Then we sent this client
back as a DHCP client.

142
05:12.925 --> 05:14.300 align:middle line:90%
So regardless of
which IP address

143
05:14.300 --> 05:16.570 align:middle line:90%
they got from the DHCP
server, the switch

144
05:16.570 --> 05:18.550 align:middle line:90%
would learn about that
from the binding table,

145
05:18.550 --> 05:21.130 align:middle line:90%
and be able to verify ARP
messages in the future coming

146
05:21.130 --> 05:23.110 align:middle line:84%
in on port 0/2.

147
05:23.110 --> 05:25.450 align:middle line:90%
So my question is,
how did you do?

148
05:25.450 --> 05:27.062 align:middle line:90%
If you have done
this lab with me,

149
05:27.062 --> 05:29.020 align:middle line:90%
or if you've done it on
your own physical gear,

150
05:29.020 --> 05:32.140 align:middle line:90%
or in a simulator or emulator,
I want you to give yourself
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
05:29.020 --> 05:32.140 align:middle line:90%
or in a simulator or emulator,
I want you to give yourself

151
05:32.140 --> 05:35.350 align:middle line:90%
another 10 points in our
journey towards 100, which

152
05:35.350 --> 05:39.140 align:middle line:90%
represents applying the skills
for learning to networks.

153
05:39.140 --> 05:41.140 align:middle line:90%
And here's the cool thing,
the more we practice,

154
05:41.140 --> 05:43.600 align:middle line:90%
and the more we get experience
in doing these commands

155
05:43.600 --> 05:45.520 align:middle line:90%
and verifying that
they work, the better

156
05:45.520 --> 05:48.220 align:middle line:90%
we are going to be in both
supporting and implementing

157
05:48.220 --> 05:51.040 align:middle line:90%
these types of solutions
in production networks.

158
05:51.040 --> 05:52.870 align:middle line:90%
And that's our
goal, to bring value

159
05:52.870 --> 05:54.610 align:middle line:90%
to our employers
and our customers

160
05:54.610 --> 05:56.200 align:middle line:90%
by being able to
do those things,

161
05:56.200 --> 05:57.827 align:middle line:90%
including security-related
tasks that

162
05:57.827 --> 05:59.410 align:middle line:90%
are going to help
improve the security

163
05:59.410 --> 06:01.400 align:middle line:84%
posture of their networks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
05:59.410 --> 06:01.400 align:middle line:84%
posture of their networks.

164
06:01.400 --> 06:02.540 align:middle line:84%
So thanks for joining me.

165
06:02.540 --> 06:03.650 align:middle line:84%
I had a lot of fun.

166
06:03.650 --> 06:05.470 align:middle line:90%
I hope this has been
informative for you,

167
06:05.470 --> 06:08.820 align:middle line:90%
and I'd like to thank
you for viewing.