topic Re: ISE & ARP inspection & DHCP snooping in Network Access Control

ISE & ARP inspection & DHCP snooping

Antonio Macia — Sat, 10 Feb 2018 16:50:52 GMT

Hello there,

Makes sense configuring arp inspection and DHCP snooping on a network where access is controlled by ISE? I mean, if access is based on dot1x and MAB using profiling and all the traffic is blocked until the device matches an authorization policy, wouldn't be redundant protections?

Regards.

Re: ISE & ARP inspection & DHCP snooping

Craig Hyps — Mon, 12 Feb 2018 14:10:22 GMT

Not clear on question. Port Security (the locking down of a port to specific authorized MAC) may be considered redundant, and in general we do not support the combination of these two features, but ARP inspection is to validate that IP address is one that is seen on port. dACLs or other enforcement could potentially block, but DHCP Snooping is complimentary as it helps verify that DHCP used and the IP address assigned to host. It is also used for instantiating dACLs.

Re: ISE & ARP inspection & DHCP snooping

Antonio Macia — Mon, 12 Feb 2018 14:42:43 GMT

Hello Chyps,

My question is aimed to get feedback on ISE deployments that might use DHCP snooping and ARP inspection on top as an added security mechanism.

They way I see it, during the first connection a device is profiled and allowed to access the network only after matching the conditions defined, so rogue DHCP servers would be prevented. Having said that, only on those exceptional cases where a legitimate device gets into the network and later enables any kind of DHCP service, then I could understand the need of DHCP snooping.

What's your take on this?

Re: ISE & ARP inspection & DHCP snooping

Craig Hyps — Mon, 12 Feb 2018 14:52:35 GMT

What prevents an authorized user from posing as a DHCP server?

Re: ISE & ARP inspection & DHCP snooping

Antonio Macia — Tue, 13 Feb 2018 10:50:54 GMT

Actually the active directory domain permissions, but as you know, shadow IT is always present, moreover on an organization with many IT specialists.

Thanks for the reply chyps, you helped me out to find a valid reason for implementing DHCP snooping and ARP spoofing.

Re: ISE & ARP inspection & DHCP snooping

ndemers — Fri, 23 Feb 2018 20:38:35 GMT

Thats where dhcp snooping comes in. trusted ports are identified as the source of dhcp servers.

Re: ISE & ARP inspection & DHCP snooping

sinady — Fri, 26 Feb 2021 07:09:32 GMT

@Antonio Macia ,

I currently, looking for implement dynamic ARP inspection with ISE.

Could you help to share me. how can do that ?

Thank in advance.