It is pretty fun to learn new things
and improve our knowledge and our skills.
And sometimes the word gets out, and that's
what's happening today with you and I as well,
regarding Dynamic ARP Inspection.
Bob has heard that we've been practicing and working with it,
and he has asked you and I once again to come to his office,
and help them implement Dynamic ARP Inspection to better
protect their network.
So let's take a look at Bob's plan,
and then we'll go to the lab.
So we meet with Bob, and this is what he tells us,
that we're going to be doing some work in Florida,
and they want to set up Dynamic ARP Inspection on VLAN 40 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and they want to set up Dynamic ARP Inspection on VLAN 40
in Florida.
So this port right here--
gig 0/2 coming off the Florida switch
is already assigned to VLAN 40.
But what we would want to do is we
would want to verify, once we get there,
that that's the case.
So don't take too much for granted.
We'll want to verify that this port is in VLAN 40.
And then Bob also wants us to trust
port 3/3, which is the port that leads off to the router.
And one of the reasons for that, of course,
is because this IP address on gig 1/3 on the router, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is because this IP address on gig 1/3 on the router,
was not dynamically assigned via DHCP.
So this is our task on the Florida switch,
is to enable DAI on VLAN 40, trust port 3/3,
and then verify that it's is working.
And we have PC-2, which is a virtual PC, which
is sitting off of that port that we can use for testing.
So if you're logged on currently to a PC,
click on the link for the virtual lab, bring the lab up,
and together we'll implement this solution for Bob
in the Florida portion of his network.
All right, so here at the switch,
let's see some verification first to show VLAN brief, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
let's see some verification first to show VLAN brief,
just to make sure that we have VLAN 40.
And we do.
Great.
There's VLAN 40, and gig 0/2 is an access port in that VLAN.
That's great.
Let's also a show CDP neighbors just
to verify that router 3 really is hanging off
gig 3/3, which it is.
Fantastic.
And let's set that up as a trusted DAI port.
So to do that, we're going to interface configuration
mode for interface gig 3/3, and we'll
do IP ARP inspection, and the keyword trust, and press Enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
do IP ARP inspection, and the keyword trust, and press Enter.
That part is done.
Click Exit, and that we'll enable
IPR inspection for VLAN 40.
So to do that, we'll do IP, ARP, inspection, VLAN
40, press Enter.
Then we'll do a show ARP inspection for VLAN 40,
just to make sure it's enabled.
There we go.
So it's enabled and it's active.
That's fantastic.
And if we looked at the DHCP snooping bindings,
we could do a show IP, DHCP snooping, with the binding. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we could do a show IP, DHCP snooping, with the binding.
And so, we have in VLAN 40, this guy right here ending
in 66:68:00 with the IP address of 101.
And that is the Florida PC-2.
And there's a tab for that one right here.
So if we go to this PC we do a show IP,
this is a virtual machine.
So here's the IP address--
10.16.22.101.
And if you did a ping to--
let's go to 10.16.22.7--
that's his default gateway.
And that works.
Great.
And one way we could test this is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And one way we could test this is
this, what if we took this PC--
PC-2-- and we gave it a different IP address
that was static.
If we gave it a static address that was different,
than the switch wouldn't have a layer 3, layer 2 mapping.
And then if it tried to do an ARP,
the switch would not be able to verify it.
And as a result, the switch should drop it right there
in port gig 0/2.
So let's do that next.
So we'll go back to our admin PC,
and we'll go to the tab for the Florida
PC-2, that virtual machine, and let's just
give it a different IP address.
So currently, it's got 101.
Let's give it 200.
So IP on this virtual machine, the syntax is 10.16.22. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So IP on this virtual machine, the syntax is 10.16.22.
And let's go ahead and use 200.
And you can throw on a mask or not.
It doesn't really matter, because we're only
going to use this temporarily.
So it believes it's IP address is
10.16.22.20 with a 24-bit mask.
And now, if we try to do a ping--
let's see if can use the up key a few times--
ping 10.16.22.7.
Hmm.
That's not so happy.
Why is that?
Well, these virtual machines have a very short ARP cache, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, these virtual machines have a very short ARP cache,
so when we did a ping for 10.16.22.7, in the background
there was an ARP request.
But the switch couldn't verify it,
because there's no entry in the DHCP snooping table.
There's no ARP ACL.
So when we go back to the switch,
sure enough, all of those ARPs were not
allowed because they couldn't be verified.
The layer 3 to layer 2 mapping couldn't
be verified by the switch with Dynamic ARP Inspection,
so it dropped them.
If we went back to our client and we got an IP address again,
via DHCP, with an IP DHCP, press Enter. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
via DHCP, with an IP DHCP, press Enter.
And it's going to visually show us
going through the discover offer request process.
If we went back to the switch, that entry
is going to be the snooping table.
So we do a show, IP, DHCP, snooping, binding.
There's the IP address that we've just got.
And now we go back to the client,
and we hit the up key a couple times, and do a ping again.
It's going to fly, because the ARP is congruent now
with what the switch can verify.
So let's do a quick check and make sure we got everything.
We enabled Dynamic ARP inspection on VLAN 40, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We enabled Dynamic ARP inspection on VLAN 40,
we trusted this port right here, and we
verified it's working by statically configuring an IP
address.
And then, when it sent an ARP it was
blocked, because the switch couldn't verify it,
and that verifies it is working.
Then we sent this client back as a DHCP client.
So regardless of which IP address
they got from the DHCP server, the switch
would learn about that from the binding table,
and be able to verify ARP messages in the future coming
in on port 0/2.
So my question is, how did you do?
If you have done this lab with me,
or if you've done it on your own physical gear,
or in a simulator or emulator, I want you to give yourself WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or in a simulator or emulator, I want you to give yourself
another 10 points in our journey towards 100, which
represents applying the skills for learning to networks.
And here's the cool thing, the more we practice,
and the more we get experience in doing these commands
and verifying that they work, the better
we are going to be in both supporting and implementing
these types of solutions in production networks.
And that's our goal, to bring value
to our employers and our customers
by being able to do those things,
including security-related tasks that
are going to help improve the security
posture of their networks. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
posture of their networks.
So thanks for joining me.
I had a lot of fun.
I hope this has been informative for you,
and I'd like to thank you for viewing.