Wired Intelligent Edge

last person joined: 8 hours ago 

Bring performance and reliability to your network with the Aruba Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of the ArubaOS-Switch and ArubaOS-CX devices, and find ways to improve security across your network to bring together a mobile first solution.
Expand all | Collapse all

CX-OS arp Inspection

This thread has been viewed 44 times
  • 1.  CX-OS arp Inspection

    Posted 12 days ago
    Hello,

    I am using CX-OS 10.08.0001 on a 6200F switch.    I am trying to validate arp inspection is working properly.  With my AOS switches I add arp protection to a vlan and then if I add a static IP device to a port on that switch arp protection will disable the port and show in the logs that the port is disabled due to arp protection.

    With CX I am not seeing anything in the logs when I add a static device and arp inspection is applied to the vlan.  I do not have any arp inspection trust configured on the switch port where the static IP device is.  

    My question is what is the best way to see ARP inspection is working and preventing a statically configured device from connecting to this switch?


    ------------------------------
    Alan Scott
    ------------------------------


  • 2.  RE: CX-OS arp Inspection

    Posted 10 days ago
    bump - Anyone have any thoughts on this one?

    ------------------------------
    Alan Scott
    ------------------------------



  • 3.  RE: CX-OS arp Inspection

    Posted 10 days ago
    What is the command you configured? What I see from documentation is that it requires port-mac-IP configuration in order to work.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 4.  RE: CX-OS arp Inspection

    Posted 10 days ago
    I have the below configured on my interfaces:

    interface 1/1/3
    no shutdown
    qos trust dscp
    description Data/Voice Port
    no routing
    vlan access 2900
    spanning-tree bpdu-guard
    spanning-tree port-type admin-edge
    aaa authentication port-access client-limit 5
    aaa authentication port-access dot1x authenticator
    max-eapol-requests 1
    max-retries 1
    quiet-period 30
    enable
    aaa authentication port-access mac-auth
    enable

    And globally I have:
    dhcpv4-snooping
    no dhcpv4-snooping option 82
    client track ip


    And VLANs I have:

    vlan1000
    name TRUSTED
    client track ip
    dhcpv4-snooping
    arp inspection
    ip igmp snooping enable

    vlan 2000
    name VOICE
    voice
    client track ip
    dhcpv4-snooping
    arp inspection
    ip igmp snooping enable

    vlan 2900
    name UNTRUSTED
    client track ip
    dhcpv4-snooping
    arp inspection
    ip igmp snooping enable

    ------------------------------
    Alan Scott
    ------------------------------



  • 5.  RE: CX-OS arp Inspection

    Posted 9 days ago
    I have not tested, but from the documentation, there is the 'show arp inspection interface' and 'show arp inspection statistics' that display the interface status and number of forwarded/dropped ARP packets.

    To see more, I would go for the 'debug arpsecurity inspection' debug logs:
    CX6300F# debug arpsecurity
      all         Enable all debug modules
      config      Enable ARP security feature's config log
      inspection  Enable ARP security inspection log
      packet      Enable ARP security feature's packet log
    CX6300F# debug arpsecurity inspection
      severity  Minimum log severity to filter debug logs
      <cr>​



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 6.  RE: CX-OS arp Inspection

    Posted 9 days ago
    @Herman Robers - early you mentioned "from documentation is that it requires port-mac-IP configuration in order to work."

    I searched CLI guide and google and I can not find any similar command.  Would you be able to assist me with the link to the guide you were looking at?  I am also opening a case.


    ------------------------------
    Alan Scott
    ------------------------------



  • 7.  RE: CX-OS arp Inspection

    Posted 9 days ago
    Here is the link to the manual with the relevant commands.

    https://www.arubanetworks.com/techdocs/AOS-CX/10.08/HTML/ip_services_6300-6400/Content/Chp_ARP/ARP_cmds/arp-com.htm


    ------------------------------
    Justin Noonan
    ------------------------------



  • 8.  RE: CX-OS arp Inspection

    Posted 8 days ago
    This is what I found for ArubaOS Switch that suggests adding bindings for static IPs. This seems to be the equivalent command on AOS-CX.

    Have not tested it, just combining information that may make sense at some point.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 9.  RE: CX-OS arp Inspection

    Posted 4 days ago
    Hi Alan,
    Do you still have problem or you have required clarification ?

    Dynamic ARP Inspection

    Note: Dynamic ARP Inspection is supported on the 6200, 6300, 6400, and 8400 platforms running AOS-CX 10.4 or later.

    Address Resolution Protocol (ARP) allows hosts to communicate over the network by creating an IP to MAC address mapping used in the transmission of packets. Attackers can use ARP to generate bogus mappings, thereby allowing them to spoof other clients' MAC addresses and intercept traffic destined to them. Additionally, an attacker could generate an unlimited number of artificial ARP entries, filling up the caches of other clients on the network and causing a denial of service (DoS).



    ARP Security Basic Configuration Steps:

    Vlan Level:
    ARP inspection is enabled on a switch by configuring it in the required VLANs
    Configure/Unconfigure
    CLI: [no ]arp inspection
    To configure arp inspection for vlan 10

    8400(config)# vlan 10
    8400(config-vlan-10)# no shut
    8400(config-vlan-10)# arp inspection
    To un-configure arp inspection for vlan 10
    8400(config)# vlan 10
    8400(config-vlan-10)# no arp inspection​


    Validation:
    CLI: show arp inspection vlan
    Example:


    8400# show arp inspection vlan 
    
    -----------------------------------------------------------------
    VLAN   Name              		ARP Inspection 
    -----------------------------------------------------------------
    1      DEFAULT_VLAN_1    	      -              
    10     VLAN10            		      enabled        
    20     VLAN20           		      -
    ​


    Interface level:
    All the interfaces under ARP Inspection enabled VLAN will be in "untrusted" state by default. All interfaces connected to routing/switching devices or to any trusted stations can be classified as "trusted". ARP traffic on the "untrusted" interfaces only will be subjected to ARP Inspection checks.
    Configure/Unconfigure
    CLI: [no] arp inspection trust
    Example:

    8400(config)# int 1/3/2
    8400(config-if)# no shutdown
    8400(config-if)# no routing
    8400(config-if)# arp inspection trust 
    8400(config-if)# int lag 1
    8400(config-lag-if)# no shutdown
    8400(config- lag-if)# no routing
    8400(config-lag-if)# arp inspection trust 
    8400(config-lag-if)# int lag 2
    8400(config-lag-if)# no shutdown
    8400(config-lag-if)# no routing
    8400(config-lag-if)# no arp inspection trust 



    Validation:
    CLI: show arp inspection interface
    Example:

    8400(config)# show arp inspection interface 
    
    ---------------------------------------------------------------------------
    Interface           Trust State         
    ---------------------------------------------------------------------------
    1/3/1               Trusted             
    1/3/2               Untrusted           
    lag1                  Trusted  
    lag2                  Untrusted           
    ---------------------------------------------------------------------------    


    DAI works closely with Dsnoop. For Dsnoop we must enable uplink as trust via which the DHCP-Server is reachable.

    Dynamic ARP Inspection

    Note: Dynamic ARP Inspection is supported on the 6200, 6300, 6400, and 8400 platforms running AOS-CX 10.4 or later.

    Address Resolution Protocol (ARP) allows hosts to communicate over the network by creating an IP to MAC address mapping used in the transmission of packets. Attackers can use ARP to generate bogus mappings, thereby allowing them to spoof other clients' MAC addresses and intercept traffic destined to them. Additionally, an attacker could generate an unlimited number of artificial ARP entries, filling up the caches of other clients on the network and causing a denial of service (DoS).

    Good day!



    ------------------------------
    Yash NN
    ------------------------------



  • 10.  RE: CX-OS arp Inspection

    Posted 4 days ago

    Yash   

    Thank you for the reply I am familiar with the validation commands you posted however I do not think they help me.  Most just tell me if ARP Inspection is enabled on a port or not.

    At the end of the day what I really want to do is prevent someone from statically configuring an IP on a device and connecting it to my switch.  If they do I want the port to reject it and I want to see something in the log about ARP Inspection disabling the port.  I have this setup in AOS Switches.  It does not have to be in the logs I just need a way for my team to quickly identify why a user is reporting they can not get a device on the network.  With a log or command we can identify the issue as a static IP which is against our policy and help them correct this.   In my testing with ARP inspection enabled and a static IP on a PC the PC works normally.


    Will ARP inspection prevent static IPs like ARP protection does in AOS?
    Is there a good command to see why a port is disabled when ARP Inspection disables it?



    ------------------------------
    Alan Scott
    ------------------------------