topic Re: ARP Spoofing in Network Security

ARP Spoofing

ahmed ferhan — Fri, 30 Sep 2022 15:19:11 GMT

Hi everyone, have a nice day

I have a big network with multiple cisco routers, switches(IOSXE, IOSXR), and NX, I found in the ARP table multiple IP addresses with the same mac address, I try to track the mac address but the port for this mac return me the previous router

please any help or explain this issue

Re: ARP Spoofing

MHM Cisco World — Fri, 30 Sep 2022 16:14:39 GMT

are there any static route toward this router

Re: ARP Spoofing

Aref Alsouqi — Fri, 30 Sep 2022 16:59:32 GMT

That could be due to a static route that is pointing to the exit interface rather than to the next hop which is not really recommended at all.

Re: ARP Spoofing

ahmed ferhan — Fri, 30 Sep 2022 19:57:08 GMT

of course, there is ..

Re: ARP Spoofing

ahmed ferhan — Fri, 30 Sep 2022 19:59:38 GMT

the default route already exist into the switch because i need the end user to reach the internet

Re: ARP Spoofing

MHM Cisco World — Fri, 30 Sep 2022 20:01:20 GMT

so config the static route as following
ip route x.x.x.x y.y.y.y <egress interface> <next-hop>
this will stop ARP issue.
for more info. check link below
https://www.cisco.com/c/en/us/support/docs/dial-access/floating-static-route/118263-technote-nexthop-00.html

Re: ARP Spoofing

ahmed ferhan — Fri, 30 Sep 2022 20:14:42 GMT

i config this route as ( ip route 0.0.0.0 0.0.0.0 + (ip which is the gateway))

Re: ARP Spoofing

MHM Cisco World — Sat, 01 Oct 2022 13:45:43 GMT

that great you already specify the the next-hop so no issue at all but for many arp let me make deep dive,
I will update you soon

Re: ARP Spoofing

ahmed ferhan — Sun, 02 Oct 2022 14:43:41 GMT

I'll be appreciated you

Re: ARP Spoofing

MHM Cisco World — Fri, 14 Oct 2022 19:16:26 GMT

hi friend
I dont forget you but I was looking for case that ARP is use for each IP in subnet
1- static route toward interface (this we discus before you confirm that you use next-hop not interface)
2- PBR with set interface

so for second case can you confirm that you use PBR?

Re: ARP Spoofing

ahmed ferhan — Sat, 15 Oct 2022 07:17:11 GMT

Hi MHM, thank you for your support, I am so appreciated your followed
into( Router and SW) I am setting two access list controls only without route-map
the first access list is used for management access and this set on ssh protocol and the second access list is used for port security ( traffic or services )that allowed to pass through the router and this set to the management interface