Protecting Against Spoof Attacks参考.ppt

Minimizing Service Loss and Data Theft in a Campus Network Protecting Against Spoof Attacks DHCP Spoof Attacks Attacker activates DHCP server on VLAN. Attacker replies to valid client DHCP requests. Attacker assigns IP configuration information that establishes rogue device as client default gateway. Attacker establishes “man-in-the-middle” attack. DHCP Snooping Securing Against DHCP Snooping Attacks Verifying DHCP Snooping IP Source Guard Configuring IP Source Guard on a Switch ARP Spoofing Dynamic ARP Inspection Configuring DAI Protection from ARP Spoofing Configure to protect against rogue DHCP servers. Configure for dynamic ARP inspection. Summary DHCP spoof attacks send unauthorized replies to DHCP queries. DHCP snooping is used to counter a DHCP spoof attack. DHCP snooping is easily implemented on a Cisco Catalyst switch. ARP spoofing can be used to redirect traffic to an unauthorized device on the network. Dynamic ARP inspection in conjunction with DHCP snooping can be used to counter ARP spoofing attacks. Configuration commands for dynamic ARP inspection are simple to understand. Dynamic APR inspection and DHCP snooping can protect against ARP spoofing attacks. Cisco Network Academy. All rights reserved.. CCNP+ BSMSN v3.0 Cisco Network Academy. All rights reserved.. CCNP+ BSMSN v3.0 DHCP snooping allows the configuration of ports as trusted or untrusted. Untrusted ports cannot process DHCP replies. Configure DHCP snooping on uplinks to a DHCP server. Do not configure DHCP snooping on client ports. Switch(config)#?ip?dhcp?snooping limit rate?[rate] Enables DHCP Option 82 data insertion Switch(config)#?ip?dhcp?snooping information?optio