Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 384)

100

101

22-2

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 22 Configuring ARP Inspection and Bridging Parameters

Configuring ARP Inspection

ARP inspection prevents malicious users from impersonating other hosts or routers (known as ARP

spoofing). ARP spoofing can enable a “man-in-the-middle” attack. For example, a host sends an

ARP request to the gateway router; the gateway router responds with the gateway router MAC address.

The attacker, however, sends another ARP response to the host with the attacker MAC address instead

of the router MAC address. The attacker can now intercept all the host traffic before forwarding it on to

the router.

ARP inspection ensures that an attacker cannot send an ARP response with the attacker MAC address,

so long as the correct MAC address and the associated IP address are in the static ARP table.

Adding a Static ARP Entry

ARP inspection compares ARP packets with static ARP entries in the ARP table. To add a static ARP

entry, enter the following command:

hostname(config)# arp

interface_name ip_address mac_address

For example, to allow ARP responses from the router at 10.1.1.1 with the MAC address 0009.7cbe.2100

on the outside interface, enter the following command:

hostname(config)# arp outside 10.1.1.1 0009.7cbe.2100

Note The transparent firewall uses dynamic ARP entries in the ARP table for traffic to and from the security

appliance, such as management traffic.

Enabling ARP Inspection

To enable ARP inspection, enter the following command:

hostname(config)# arp-inspection

interface_name

enable [flood | no-flood]

Where flood forwards non-matching ARP packets out all interfaces, and no-flood drops non-matching

packets.

Note The default setting is to flood non-matching packets. To restrict ARP through the security appliance to

only static entries, then set this command to no-flood.

For example, to enable ARP inspection on the outside interface, and to drop all non-matching ARP

packets, enter the following command:

hostname(config)# arp-inspection outside

enable no-flood

To view the current settings for ARP inspection on all interfaces, enter the show arp-inspection

command.

1 2 ... 379 380 381 382 383 384 385 386 387 388 389 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 384

Komentarze do niniejszej Instrukcji