Dynamic ARP Inspection

AltaNivel 1Revisión manualaruba-cx

Descripción

Dynamic ARP Inspection (DAI) is a security feature available in AOS-CX switches that validates ARP packets on the network to prevent ARP spoofing and ARP-based man-in- the-middle attacks. It verifies ARP requests and responses against trusted sources, such as DHCP snooping and static ARP entries.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Run 'show arp inspection vlan' and 'show arp inspection statistics'. Dynamic ARP inspection must be enabled on user VLANs, with only uplinks/infrastructure ports trusted ('arp inspection trust').

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Following command enables Dynamic ARP inspection on the current VLAN, which means that ARP packets received from untrusted interfaces are discarded if they have an Invalid IP-to-MAC address binding - vlan <vlan-id> arp inspection Configures the interface as a trusted. All interfaces are untrusted by default - interface <interface-id> arp inspection trust Dynamic ARP Inspection is enforced using DHCP Snooping binding and Static IP Binding. Refer to the DHCP Snooping section for the DHCP snooping configuration. To enable the Static IP Binding use the below configuration - vlan <vlan-id> arp ipv4 <IPV4_ADDR> mac <MAC_ADDR>

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: aruba-cxthreat-prevention
Referencia: CIS HPE Aruba Networking CX Switch Benchmark v1.0.1 - 3.5 Dynamic ARP Inspection