Brocade Communications Systems ICX 7250 series, Руководство по настройке

Страница: 31 / 483

NOTE
You must save the configuration to the startup-config file and reload the software after changing the RARP cache size to place
the change into effect.
Dynamic ARP inspection
For enhanced network security, you can configure the Brocade device to inspect and keep track of Dynamic Host Configuration Protocol
(DHCP) assignments.
Dynamic ARP Inspection (DAI) enables the Brocade device to intercept and examine all ARP request and response packets in a subnet
and discard packets with invalid IP-to-MAC address bindings. DAI can prevent common man-in-the-middle (MiM) attacks such as ARP
cache poisoning, and disallow mis-configuration of client IP addresses.
DAI allows only valid ARP requests and responses to be forwarded and supports Multi-VRFs with overlapping address spaces. For more
information on DAI, refer to the
Brocade FastIron Security Configuration Guide .
ARP poisoning
ARP provides IP communication within a Layer 2 broadcast domain by mapping an IP address to a MAC address. Before a host can talk
to another host, it must map the IP address to a MAC address first. If the host does not have the mapping in its ARP table, it creates an
ARP request to resolve the mapping. All computers on the subnet will receive and process the ARP requests, and the host whose IP
address matches the IP address in the request will send an ARP reply.
An ARP poisoning attack can target hosts, switches, and routers connected to the Layer 2 network by poisoning the ARP caches of
systems connected to the subnet and by intercepting traffic intended for other hosts on the subnet. For instance, a malicious host can
reply to an ARP request with its own MAC address, thereby causing other hosts on the same subnet to store this information in their ARP
tables or replace the existing ARP entry. Furthermore, a host can send gratuitous replies without having received any ARP requests. A
malicious host can also send out ARP packets claiming to have an IP address that actually belongs to another host (for example, the
default router). After the attack, all traffic from the device under attack flows through the attacker computer and then to the router, switch,
or host.
Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) allows only valid ARP requests and responses to be forwarded.
A Brocade device on which DAI is configured does the following:
• Intercepts ARP packets received by the system CPU
• Inspects all ARP requests and responses received on untrusted ports
• Verifies that each of the intercepted packets has a valid IP-to-MAC address binding before updating the local ARP table, or
before forwarding the packet to the appropriate destination
• Drops invalid ARP packets
When you enable DAI on a VLAN, by default, all member ports are untrusted. You must manually configure trusted ports. In a typical
network configuration, ports connected to host ports are untrusted. You configure ports connected to other switches or routers as trusted.
DAI inspects ARP packets received on untrusted ports, as shown in the figure below. DAI carries out the inspection based on IP-to-MAC
address bindings stored in a trusted binding database. For the Brocade device, the binding database is the ARP table and the DHCP
snooping table, which supports DAI, DHCP snooping, and IP Source Guard. To inspect an ARP request packet, DAI checks the source IP
Dynamic ARP inspection
Brocade FastIron Layer 3 Routing Configuration Guide
53-1003903-04 31