DHCP-Secured IP Address Assignment

Problem

You wish to synchronize the ARP entries to the DHCP bindings to prevent IP address spoofing.

Solution

To enable secured IP address assignment, use the update arp command:

Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#ip dhcp pool OREILLY Router1(dhcp-config)#update arp Router1(dhcp-config)#end Router1#

 

Discussion

Beginning with IOS Version 12.2(15)T, Cisco introduced the concept of DHCP secured IP address assignment. This feature synchronizes the ARP entry to the DHCP binding to ensure that IP addresses assign via DHCP can't be spoofed. By default, ARP tables dynamically map MAC addresses to IP addresses to facilitate communication. Unfortunately, it's rather easy for someone to spoof a DHCP assigned IP address and overwrite the router's ARP cache with his own MAC address.

Once the DHCP-secured IP address assignment is enabled, the router adds a secured ARP entry for each DHCP binding. This ensures that the ARP entry cannot be dynamically, or even manually, erased or overwritten. In fact, the only way to clear a secured ARP entry is by releasing the DHCP lease.

The following is an example configuration of DHCP-secured IP address assignment:

Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#ip dhcp pool OREILLY Router1(dhcp-config)#network 172.25.1.0 255.255.255.0 Router1(dhcp-config)#default-router 172.25.1.1 Router1(dhcp-config)#dns-server 172.25.1.1 172.25.1.3 Router1(dhcp-config)#domain-name oreilly.com Router1(dhcp-config)#lease 3 Router1(dhcp-config)#update arp Router1(dhcp-config)#end Router1#

Once configured, the router will provide DHCP leases as normal; however, for each new binding, the router will also add a secured ARP entry. All of this is completely transparent to the end users. The next example shows three newly assigned DHCP leases:

Router1#show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type Hardware address/ User name 172.25.1.51 0100.0d60.b21a.4c Aug 24 2006 04:20 PM Automatic 172.25.1.52 0100.104b.33da.73 Aug 24 2006 04:22 PM Automatic 172.25.1.53 0100.0475.839d.3f Aug 24 2006 04:48 PM Automatic Router1#

To confirm that the router has indeed created secured ARP entries, use the following command:

Router1#show ip dhcp server statistics Memory usage 108579 Address pools 1 Database agents 0 Automatic bindings 3 Manual bindings 0 Expired bindings 0 Malformed messages 0 Secure arp entries 3 Message Received BOOTREQUEST 0 DHCPDISCOVER 135 DHCPREQUEST 18 DHCPDECLINE 0 DHCPRELEASE 13 DHCPINFORM 0 Message Sent BOOTREPLY 0 DHCPOFFER 24 DHCPACK 13 DHCPNAK 1 Router1#

Notice that the router has three new secured ARP entries, as highlighted in the previous example.

You can add the update arp command to existing DHCP pools; however, the router will only create secured ARP entries once existing leases are renewed. Once leases are renewed, the router will automatically create secured ARP entries for the renewed DHCP bindings.

As we mentioned earlier, secured ARP entries cannot be erased manually. For instance, clearing the router's ARP cache does not erase the secured ARP entries:

Router1#clear arp-cache Router1#show arp Protocol Address Age (min) Hardware Addr Type Interface Internet 10.1.1.1 - 000e.8424.4e71 ARPA FastEthernet0/1 Internet 10.1.1.17 0 000d.bcef.f638 ARPA FastEthernet0/1 Internet 172.25.1.52 31 0010.4b33.da73 ARPA FastEthernet0/0 Internet 172.25.1.53 25 0004.7583.9d3f ARPA FastEthernet0/0 Internet 172.25.1.51 33 000d.60b2.1a4c ARPA FastEthernet0/0 Internet 172.25.1.5 0 0001.9670.b780 ARPA FastEthernet0/0 Internet 172.25.1.1 0 0010.4b09.5700 ARPA FastEthernet0/0 Internet 172.25.1.3 0 000a.5e40.0126 ARPA FastEthernet0/0 Internet 172.25.1.101 - 000e.8424.4e70 ARPA FastEthernet0/0 Router1#

Notice that the age of the secured ARP entries remained the same even after we cleared the ARP cache. The secured ARP entries will remain in the ARP cache until the associated DHCP lease is terminated by either the client or DHCP server.

The router can only secure directly connected clients on LAN interfaces.

Категории