89、交换机安全欺骗攻击配置实验之Dynamic ARP Inspection

1、Dynamic ARP Inspection解析
结合DHCP Snooping，当配置了Dynamic ARP Inspection的交换机untrusted接口收到ARP信息后，交换机首先检查dhcp snooping binding，如果发现与绑定条目不一致，就丢弃收到的数据包。

2、实验拓扑

3、基础配置IOU3配置no ip routingip dhcp pool pool3 network 3.3.3.0 255.255.255.0 interface Ethernet0/0 ip address 3.3.3.3 255.255.255.0
IOU4配置no ip routingip dhcp pool pool4 network 4.4.4.0 255.255.255.0interface Ethernet0/0 ip address 4.4.4.4 255.255.255.0
IOU5配置interface Ethernet0/0 ip address dhcp
4、DHCP Snooping配置IOU1配置ip dhcp snooping vlan 1ip dhcp snoopinginterface Ethernet0/1 ip dhcp snooping trustinterface Ethernet0/2 ip dhcp snooping trust
IOU2配置ip dhcp snooping vlan 1ip dhcp snoopinginterface Ethernet0/2 ip dhcp snooping trust
IOU3配置ip dhcp relay information trust-all
IOU4配置ip dhcp relay information trust-all

5、Dynamic ARP Inspection配置
IOU1配置

ip arp inspection vlan 1
interface Ethernet0/1ip arp inspection trust interface Ethernet0/2ip arp inspection trust

IOU2配置
ip arp inspection vlan 1interface Ethernet0/2ip arp inspection trust
本文出自 “开源殿堂” 博客，请务必保留此出处http://kaiyuandiantang.blog.51cto.com/10699754/1734179