Allied Telesis Layer 3 Switches Identifying the user, IP spoofing and tracking, Trouble with ARP

Page 14

Identifying the user

Identifying the user

This section describes methods for authorising and tracking users and preventing them from changing their identity on the network.

IP spoofing and tracking

Unknown users who attempt to change IP address—to circumvent billing or to hide their identity—can be a problem for administrators.

Changing IP address for malicious reasons is most commonly called IP spoofing, and is also known as ARP spoofing, ARP poisoning, and ARP poison routing (APR). The net result is the same for all of these: the victim ends up with false information in its ARP table.

The trouble with ARP

IP Spoofing takes advantage of the inherently insecure design of ARP. In an Ethernet network, a client may use a Gratuitous ARP (GARP), or merely send an ARP request or reply with false information, to announce a phoney identity to the local subnet.

A phoney announcement may be made in a number of ways for a number of reasons. The following table briefly explains these factors.

If the ARP or GARP packet contains...

Then...

MAC that does not exist on network and IP address that does not exist on network

the attacker may be trying to fill up the IP ARP table so that the subnet’s router cannot learn more addresses. As a result, return (routed) traffic may not be forwarded.

MAC that is owned by attacker and

the attacker is using an IP address that the

IP address that does not exist on network

administrator has not assigned and so may be trying

 

to avoid traceability.

 

 

MAC that is owned by attacker and

the attacker is trying to intercept traffic destined for

IP address that is owned by another host

this host.

 

 

MAC that is owned by attacker and

the attacker is trying to intercept all traffic leaving

IP address that is owned by the subnet router

the subnet.

 

 

MAC does not exist on network and

the attacker is trying to cause traffic to this IP

IP address that exists on network

address to flood to all hosts in the subnet. However,

 

hosts disregard the flooded traffic because it is not

 

addressed with any host’s MAC address. This means

 

that the attacker receives the traffic and its intended

 

recipient ignores it.

 

 

The techniques for protecting the network are the same for all these phoney announcements: reject gratuitous ARPs, and control access to ports with DHCP snooping and ARP security. The following sections describe these solutions in detail.

Create A Secure Network With Allied Telesis Managed Layer 3 Switches

14

Page 13 Page 15
Image 14
Page 13 Page 15
Contents
Contents IntroductionEdge switch Access Router Protecting against packet flooding Securing the deviceProtecting the network Bandwidth limiting Using QoS policy-based storm protection Configuration To use storm protectionConfiguration on one or more ports Reboot after turning on enhanced modeRest of the QoS configuration is as normal, so Protecting against rapid MAC movementControlling multicast traffic Igmp snoopingIgmp throttling Configuration For each portIgmp filtering Managing the device securely Using Secure Shell SSHConfiguration Configuration 1. Enable Snmp Using SSL for secure web accessUsing SNMPv3 Managing the device securely Whitelisting telnet hosts Building a whitelist through layer 3 filtersBuilding a whitelist through QoS Trouble with ARP Identifying the userIP spoofing and tracking Rejecting Gratuitous ARP Garp Dhcp snoopingSetting up Dhcp snooping Using static binding for rigid controlUsing ARP security Using 802.1x port authenticationUsing Dhcp snooping to track clients Using private VLANs Protecting the userUsing local proxy ARP and MAC-forced forwarding To remove ports from the VlanLocal proxy ARP Configuration of access router Example Add ip int=vlan104 ip=address-in-192.168.4.0-subnet MAC-Forced Forwarding Macff Access Using IPsec to make VPNsSwitches EdgeProtecting against worms Blocking worms through classifier-based filtersBlocking worms through QoS actions Edge switch Edge switch 1 is directly connected to the access routerEdge switch Add ip int=vlan500 ip=172.16.5.103 mask=255.255.255.0 Access Router C613-16103-00 REV a