网络互联PPT情境2交换技术_5DHCP.pptVIP

* * gratuitous ARP无故arp或者免费arp * ARP没有验证机制 * * * * ARP Spoofing 攻击 Dynamic ARP Inspection (DAI) DAI 推荐配置 DAI基于DHCP Snooping来工作，DHCP Snooping监听绑定表包括IP地址与MAC地址的绑定信息，并将其与特定的交换机端口相关联，动态ARP检测可以用来检查所有非信任端口的ARP请求和应答(主动式ARP和非主动式ARP)，确保应答来自真正的ARP所有者。 如果ARP包从一个可信任的接口接受到，就不需要做任何检查；如果ARP包在一个不可信任的接口上接收到，该包就只能在绑定信息被证明合法的情况下才会被转发出去。 DAI 配置命令 Command Description Switch(config)# ip arp inspection vlan vlan_id [vlan_id] Enables DAI on a VLAN or range of VLAN’s. Switch(config-if)# ip arp inspection trust Enables DAI on an interface and sets the interface as a trusted interface. Switch(config)# ip arp inspection validate {[src-mac] [dst-mac] [ip]} Configures DAI to drop ARP packets when the IP addresses are invalid, or when the MAC addresses in the body of the ARP packets do not match the addresses specified in the Ethernet header. DAI 配置举例 SwitchA# configure terminal Enter configuration commands, one per line. End with CNTL/Z. SwitchA(config)# ip arp inspection vlan 10 SwitchA(config)# interface gigabitEthernet 1/1 SwitchA(config-if)# ip arp inspection trust SwitchA(config-if)# end SwitchB# configure terminal Enter configuration commands, one per line. End with CNTL/Z. SwitchB(config)# ip arp inspection vlan 10 SwitchB(config)# interface gigabitEthernet 1/1 SwitchB(config-if)# ip arp inspection trust SwitchB(config-if)# end DAI配置验证 SwitchA# show ip arp inspection interfaces Interface Trust State Rate (pps) Burst Interval --------------- ----------- ---------- -------------- Gi1/1 Trusted None N/A Gi1/2 Untrusted 15 1 Fa2/1 Untrusted 15 1 Fa2/2 Untrusted 15 1 SwitchA# show ip arp inspection vlan 10 Source Mac Validation : Disabled Destination Mac Validation : Disabled IP Address Validation : Disabled Vlan Configuration Operation ACL Match Static ACL ---- ------------- --------- --------- ---------- 10 Enabled Active Vlan ACL Logging DHCP Logging ---- ----------- ------------ 10 Deny Deny SwitchA# show ip dhcp snooping binding MacAdd