ISE & ARP inspection & DHCP snooping

[Antonio Macia]

Hello there,

Makes sense configuring arp inspection and DHCP snooping on a network where access is controlled by ISE? I mean, if access is based on dot1x and MAB using profiling and all the traffic is blocked until the device matches an authorization policy, wouldn't be redundant protections?

Regards.

[Craig Hyps · Accepted solution]

Not clear on question.  Port Security (the locking down of a port to specific authorized MAC) may be considered redundant, and in general we do not support the combination of these two features, but ARP inspection is to validate that IP address is one that is seen on port.  dACLs or other enforcement could potentially block, but DHCP Snooping is complimentary as it helps verify that DHCP used and the IP address assigned to host.  It is also used for instantiating dACLs.

[Antonio Macia]

Hello Chyps,

My question is aimed to get feedback on ISE deployments that might use DHCP snooping and ARP inspection on top as an added security mechanism.

They way I see it, during the first connection a device is profiled and allowed to access the network only after matching the conditions defined, so rogue DHCP servers would be prevented. Having said that, only on those exceptional cases where a legitimate device gets into the network and later enables any kind of DHCP service, then I could understand the need of DHCP snooping.

What's your take on this?

[Craig Hyps]

What prevents an authorized user from posing as a DHCP server?

[Antonio Macia]

Actually the active directory domain  permissions, but as you know, shadow IT is always present, moreover on an organization with many IT specialists.

Thanks for the reply chyps, you helped me out to find a valid reason for implementing DHCP snooping and ARP spoofing.

[sinady]

@Antonio Macia ,

I currently, looking for implement dynamic ARP inspection with ISE.

Could you help to share me. how can do that ?

Thank in advance.

[ndemers]

Thats where dhcp snooping comes in.  trusted ports are identified as the source of dhcp servers.