BGP update-source and ARP Inspection

[frknl]

Hi there, i'm learning BGP slowly nowadays and one thing that i don't understand from security perspective is using another IP with same MAC address.

So here is a simple and basic config

R1 F0/0           >---<      F0/0 R2

192.168.0.1                   192.168.0.2

AS10                               AS10




R1> router bgp 10

neighbor 192.168.0.2 remote-as 10




R2> router bgp 10

neighbor 192.168.0.1 remote-as 10

At this point two routers populated ARP tables and there is a one IP address and corresponding MAC.

Let's say R1 MAC: AA:AA:AA R2 MAC: BB:BB:BB

R1 ARP table > 192.168.0.2 BB:BB:BB

R2 ARP table > 192.168.0.1 AA:AA:AA

Two routers on same L2 segment and same subnet. Even they don't need IP's for communicating they use IP for TCP requirements. So far so good everything works.

Now, when R1 wanst a loopback0 with 100.0.0.1 255.255.255.0 to be used with BGP source-update option it's add this.

R1> Neighbor 192.168.0.2 remote-as 10 source-update loopback 0

For proper communication, we add to R2:

R2> Neighbor 100.0.0.1 remote-as 10

ip route 100.0.0.1 255.255.255.0 192.168.0.1

Now, older neighborship is dead and new neighborship is up. But even the using R1's real interface MAC address for loopback IP source, R2 also recieved new ARP for 100.0.0.1 and it's pointing out to already existed MAC address.

I'm not sure dynamic ARP inspection is a special feature to swtiches and no routers have this, but maybe if we use a switch between two routers and/or another security mechanism to protect our domain like IP - MAC bindings, what is the result of this scenario from R2's perspective? 

The problem isn't multiple packets that recieved with same MAC and different IP's, the problem is ARP.

Thank you.

[MHM Cisco World]

I get your point 
other Peer use static route and use next-hop send ARP to ask MAC of next-hop to build frame,
the next-hop reply and hence the peer now have 
IP-MAC

how can I protect this 
you can do DAI with ACL 
but this protect only from MAC spoofing not other attack.

example:-

SW# arp access-list H2

SW(config-arp-nacl)# permit ip host 1.1.1.1 mac host 1.1.1

[frknl]

Hi, i guess ARP query never sent. 

See: https://community.cisco.com/t5/routing/bgp-update-source-and-arp-inspection/m-p/4626306/highlight/true#M368163

[Richard Burts]

It is not unusual, and in general is not a problem, for multiple IP addresses to have the same mac address shown in the arp table. I have not tested but do not believe that arp inspection would change this behavior.

[frknl]

Hi Richard,

Thanks for your response.

I realized that R2 newer starts a ARP process because of static route and there is no directly connected segment for 100.0.0.0

So it's always transmit packets properly. I guess this is fair solution

[Harold Ritter · Accepted solution]

Hi @frknl ,

R2 will not send an ARP request sent for 100.0.0.1. It has an IP route for 100.0.0.1 with a next hop of 192.168.0.1. It simply need to resolve the directly connected next hop, not the 100.0.0.1 as such.

Regards,

[frknl]

Hi Harold.

After two and half hour İntrodouction to BGP webinar, my mind is flying around.

You are totally correct and i marked as solution for this topic.

Thanks.

[Harold Ritter]

You are very welcome @frknl . Good learning