You know what's really cool, is that Cisco
creates a lot of amazing functionality
and features in their products.
And what I'd like to do is chat with you about a security
feature called Dynamic ARP Inspection,
and explain to you in this video why it's important, why
we need it, and how it works.
And so, one are the core ideas about Dynamic ARP Inspection
is that we're going to protect the network from devices
like PC-A or PC-B or PC-C lying about what they're
layer 2 information is when they respond and work with ARP.
So let's take a look before there WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's take a look before there
is any maliciousness with ARP messages,
and let's build in our mind the ARP table in PC-A.
So let's imagine that in this VLAN,
PC-A or Host-A was talking to Host-C,
and in order to communicate, PC-A did an ARP request
and discovered what Host-C's MAC address was.
So in the ARP cache, here in the mind of Host-A,
it would say, OK, to get to the IP address of Host-C,
I'm going to go ahead and use the MAC address
of Host-C. No problem.
And if we looked at Host-C, its ARP cache
would look something like this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
would look something like this.
It would say, to get to Host-A it would use the IP
address of IP-A the MAC address of Host-A. So
that looks pretty straightforward,
and that's all well and good, until this attacker steps in
and he is going to play the bad guy running malicious software.
And what does this malicious software do?
It's going to lie and it's going to send out an ARP message--
and it could be a gratuitous ARP,
meaning it wasn't an ARP that was solicited.
And in the ARP message that Host-B is sending out, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in the ARP message that Host-B is sending out,
its saying, to get to IP-C, go ahead and use my MAC address,
MAC-B. And if Host-A buys into that, it updates its ARP cache
and says, OK, great.
Got your MAC address.
No problem.
If I ever need to forward a frame to you
at your IP address, I'll send it to your layer 2 address.
And then future frames, as they go into the switch,
will be forwarded to the attacker.
And the attacker would do the same thing over here.
It would send out a gratuitous ARP,
and then it would say, hey, to get to IP address A, over here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then it would say, hey, to get to IP address A, over here,
go ahead and use this MAC address, which is MAC-B.
So Host-C says, oh!
Updated information!
Great!
I'm going to use MAC-B.
So now, if Host-A and Host-C are talking to each other,
they're forwarding frames to the attacker's layer 2 address, who
then can see all those packets.
And if the software is any good that this attacker is running,
he very likely is forwarding on the traffic
after he's had a chance to either eavesdrop
and or manipulate that traffic in transit.
So from Host-A and Host-C's perspective,
they think they're talking to each other. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they think they're talking to each other.
But in reality, it's going through the Host-B.
So the question may come up, OK, great.
That's a problem.
How do we solve it?
How do we prevent Host-B from sending out bogus and incorrect
layer 2 ARP messages?
And the answer is Dynamic ARP Inspection,
or as his friends call him--
DAI.
And so, if we apply Dynamic ARP Inspection
to VLAN 30, all the ports in VLAN 30 that are untrusted--
and by default, they're all untrusted ports-- an now
there's an ARP message that goes into the switch. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there's an ARP message that goes into the switch.
The switch is going to check, hey, is that your IP address?
Hey is that your layer 2 address?
And if there's any shenanigans going on
and where they don't line up, the switch
is simply going to drop that ARP message
so it doesn't go into the switch,
and does not reach its intended victim.
So in this video, we've taken a look
at the problem of a device maliciously
lying about layer 2 address information
to other devices on that same network.
We'll solve that with Dynamic ARP Inspection,
and we'll take a look at the commands
for implementing Dynamic ARP Inspection in the very
next video.
So I'll see you there in just a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.