Protect my Lan against ARP spoofing/Poisoning

[mydi88]

Hello, 

I am suffering against arp attacks into my Lan (Netcut -  selfishnet). What configuration i must do in my CISCO SWITCH 2960 to stop this

[Seb Rupik]

Hi there,

Take a look at Dynamic ARP Inspection:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01111.html

cheers,

Seb.

[mydi88]

Could i drop all my VLans and conserve just this configuration to protect my Lan ? Because of massive attacks i configured VLans to limit attacks in some zones.

Now if i use this config, can i use my switch in simple mode without VLans?

[kubn2]

You can but its not recommended. You can use dynamic arp inspection with vlans on switch

[mydi88]

Okay, so i have just to enter this configuration in each interface (pre-configured with VLan).

Could you give the specific configuration of Dynamic ARP Inspection in VLan Environment

Exp: i have VLan 10 in interface 1 using this ip adresse 192.168.10.1 and have his own DHCP mode and linked with gateway 192.168.99.1 in interface 24

[kubn2]

Based on this instruction linked above by Seb Rupik: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01111.html#task_1961618808BA41BA941D3B9979D36518

You turning ARP inspection per vlan basis (or you can turn it on on vlan range) so for vlan 10:
-ip arp inspection vlan 10
And remember to set some ports as trusted (between switches and port to dhcp server).

[Seb Rupik]

hmmm how epidemic is this attack?! If you unify all of your connected devices into a single subnet/ VLAN then you put all of the devcies at risk from the ARP attack.

By using VLANs you reduce the broadcast domain and therefore the reach of an ARP based attack.

I would keep the VLANs and implement DAI. Don't adjust your topology, get the switch to do the work.

cheers,

Seb.