Dynamic ARP Inspection

ÉlevéeNiveau 1Revue manuellearuba-cx

Description

Dynamic ARP Inspection (DAI) is a security feature available in AOS-CX switches that validates ARP packets on the network to prevent ARP spoofing and ARP-based man-in- the-middle attacks. It verifies ARP requests and responses against trusted sources, such as DHCP snooping and static ARP entries.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Run 'show arp inspection vlan' and 'show arp inspection statistics'. Dynamic ARP inspection must be enabled on user VLANs, with only uplinks/infrastructure ports trusted ('arp inspection trust').

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Following command enables Dynamic ARP inspection on the current VLAN, which means that ARP packets received from untrusted interfaces are discarded if they have an Invalid IP-to-MAC address binding - vlan <vlan-id> arp inspection Configures the interface as a trusted. All interfaces are untrusted by default - interface <interface-id> arp inspection trust Dynamic ARP Inspection is enforced using DHCP Snooping binding and Static IP Binding. Refer to the DHCP Snooping section for the DHCP snooping configuration. To enable the Static IP Binding use the below configuration - vlan <vlan-id> arp ipv4 <IPV4_ADDR> mac <MAC_ADDR>

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: aruba-cxthreat-prevention
Référence: CIS HPE Aruba Networking CX Switch Benchmark v1.0.1 - 3.5 Dynamic ARP Inspection