89、交换机安全欺骗攻击配置实验之Dynamic ARP Inspection

1、Dynamic ARP Inspection解析

结合DHCP Snooping，当配置了Dynamic ARP Inspection的交换机untrusted接口收到ARP信息后，交换机首先检查dhcp snooping binding，如果发现与绑定条目不一致，就丢弃收到的数据包。

2、实验拓扑

3、基础配置

IOU3配置

no ip routing

ip dhcp pool pool3

 network 3.3.3.0 255.255.255.0        

interface Ethernet0/0

 ip address 3.3.3.3 255.255.255.0

IOU4配置

no ip routing

ip dhcp pool pool4

 network 4.4.4.0 255.255.255.0

interface Ethernet0/0

 ip address 4.4.4.4 255.255.255.0

IOU5配置

interface Ethernet0/0

 ip address dhcp

4、DHCP Snooping配置

IOU1配置

ip dhcp snooping vlan 1

ip dhcp snooping

interface Ethernet0/1

 ip dhcp snooping trust

interface Ethernet0/2

 ip dhcp snooping trust

IOU2配置

ip dhcp snooping vlan 1

ip dhcp snooping

interface Ethernet0/2

 ip dhcp snooping trust

IOU3配置

ip dhcp relay information trust-all 

IOU4配置

ip dhcp relay information trust-all 

5、Dynamic ARP Inspection配置

IOU1配置

ip arp inspection vlan 1

interface Ethernet0/1

ip arp inspection trust 

interface Ethernet0/2

ip arp inspection trust 

IOU2配置

ip arp inspection vlan 1

interface Ethernet0/2

ip arp inspection trust