
19-2
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 19 Configuring ARP Inspection and Bridging Parameters
Configuring ARP Inspection
ARP inspection prevents malicious users from impersonating other hosts or routers (known as ARP
spoofing). ARP spoofing can enable a “man-in-the-middle” attack. For example, a host sends an
ARP request to the gateway router; the gateway router responds with the gateway router MAC address.
The attacker, however, sends another ARP response to the host with the attacker MAC address instead
of the router MAC address. The attacker can now intercept all the host traffic before forwarding it on to
the router.
ARP inspection ensures that an attacker cannot send an ARP response with the attacker MAC address,
so long as the correct MAC address and the associated IP address are in the static ARP table.
Adding a Static ARP Entry
ARP inspection compares ARP packets with static ARP entries in the ARP table. To add a static ARP
entry, enter the following command:
hostname(config)#
arp
interface_name ip_address mac_address
Where the
interface_name
is the source interface for the ARP packets. The
ip_address
is the source
address, and
mac_address
is the associated MAC address.
For example, to allow ARP responses from the router at 10.1.1.1 with the MAC address 0009.7cbe.2100
on the outside interface, enter the following command:
hostname(config)#
arp outside 10.1.1.1 0009.7cbe.2100
Note
The transparent firewall uses dynamic ARP entries in the ARP table for traffic to and from the FWSM,
such as management traffic.
Enabling ARP Inspection
To enable ARP inspection, enter the following command:
hostname(config)#
arp-inspection
interface_name
enable
[
flood
|
no-flood
]
Where the
interface_name
is the interface on which you want to enable ARP inspection. The
flood
keyword
forwards non-matching ARP packets out all interfaces, and
no-flood
drops non-matching
packets.
Note
The default setting is to flood non-matching packets. To restrict ARP through the FWSM to only static
entries, then set this command to
no-flood
.
For example, to enable ARP inspection on the outside interface, and to drop all non-matching ARP
packets, enter the following command:
hostname(config)#
arp-inspection outside
enable
no-flood
To view the current settings for ARP inspection on all interfaces, enter the
show arp-inspection
command.
Summary of Contents for 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion
Page 35: ...P A R T 1 Getting Started and General Information ...
Page 36: ......
Page 297: ...P A R T 2 Configuring the Security Policy ...
Page 298: ......
Page 521: ...P A R T 3 System Administration ...
Page 522: ......
Page 613: ...P A R T 4 Reference ...
Page 614: ......