topic Re: Protect my Lan against ARP spoofing/Poisoning in Network Security

Protect my Lan against ARP spoofing/Poisoning

mydi88 — Fri, 21 Feb 2020 17:38:36 GMT

Hello,

I am suffering against arp attacks into my Lan (Netcut - selfishnet). What configuration i must do in my CISCO SWITCH 2960 to stop this

Re: Protect my Lan against ARP spoofing/Poisoning

Seb Rupik — Wed, 30 Oct 2019 10:00:09 GMT

Hi there,

Take a look at Dynamic ARP Inspection:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01111.html

cheers,

Seb.

Re: Protect my Lan against ARP spoofing/Poisoning

mydi88 — Wed, 30 Oct 2019 10:23:22 GMT

Could i drop all my VLans and conserve just this configuration to protect my Lan ? Because of massive attacks i configured VLans to limit attacks in some zones.

Now if i use this config, can i use my switch in simple mode without VLans?

Re: Protect my Lan against ARP spoofing/Poisoning

kubn2 — Wed, 30 Oct 2019 10:42:04 GMT

You can but its not recommended. You can use dynamic arp inspection with vlans on switch

Re: Protect my Lan against ARP spoofing/Poisoning

Seb Rupik — Wed, 30 Oct 2019 10:53:04 GMT

hmmm how epidemic is this attack?! If you unify all of your connected devices into a single subnet/ VLAN then you put all of the devcies at risk from the ARP attack.

By using VLANs you reduce the broadcast domain and therefore the reach of an ARP based attack.

I would keep the VLANs and implement DAI. Don't adjust your topology, get the switch to do the work.

cheers,

Seb.

Re: Protect my Lan against ARP spoofing/Poisoning

mydi88 — Wed, 30 Oct 2019 10:57:06 GMT

Okay, so i have just to enter this configuration in each interface (pre-configured with VLan).

Could you give the specific configuration of Dynamic ARP Inspection in VLan Environment

Exp: i have VLan 10 in interface 1 using this ip adresse 192.168.10.1 and have his own DHCP mode and linked with gateway 192.168.99.1 in interface 24

Re: Protect my Lan against ARP spoofing/Poisoning

kubn2 — Wed, 30 Oct 2019 11:06:31 GMT

Based on this instruction linked above by Seb Rupik: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01111.html#task_1961618808BA41BA941D3B9979D36518

You turning ARP inspection per vlan basis (or you can turn it on on vlan range) so for vlan 10:
-ip arp inspection vlan 10
And remember to set some ports as trusted (between switches and port to dhcp server).