Zebra What are you doing.
How are you a nasty zebra worth while guarding zebra.
Let's break some model locks in this video.
I'm gonna show you how to implement dynamic up inspection dynamic up inspection stops attacks such as
OP poisoning.
And man in the middle attacks in a previous video which I've linked here and below I showed you how
to use Kelly or Collie Linux if you prefer to implement a man in the middle attack by poisoning of the
OP caches of devices.
We had Kelly poisoning the OP cache of a Windows device and a Cisco router and then implementing a man
in the middle attack where all traffic from that Windows host to its default gateway.
The Cisco rider was routed or switched in this case through the Kelly linux host So Carly was able to
see all the traffic from Windows to the rider and windows to the Internet.
As an example we were able to capture telnet passwords and HDP passwords.
You shouldn't be using clear text protocols in your network today so you shouldn't be using protocols
such as HDP or telnet but if someone did use clear text passwords I'd have visibility of those passwords
and have visibility of the data because all traffic is sent through the Kelly linux host.
Which in this case implemented a man in the middle attack.
We can stop that kind of nonsense by implementing dynamic OP inspection dynamic OP inspection requires
either DHB snooping or that you manually configure MAC addresses these switches basically snooping or
listening in on the HP requests from hosts or devices to the DHB server and then is creating dynamically
when using DHB snooping a MAC address to IP address mapping to an interface.
So it says this MAC address this IP address belongs on this interface.
If you change your mac address that traffic is denied and I'm going to demonstrate that using Kelly
Linux in this video.
So I'm going to show you how you can implement the HP snooping dynamic OP inspection and then stop Kelly
from sending traffic when it changes its Mac address.
So we're going to stop stop poisoning attacks.
Now to make it easier I've added this presentation below this video.
This presentation shows you the network that I'm using and then shows you how to configure dynamic IP
inspection.
So I've got links in here to Cisco and other websites that give you more information but I also show
you how to configure both DHB snooping as well as dynamic of inspection.
So in this video I'm going to show you quite a lot of detail how this all works.
Use the menu here to jump to a specific topic if you want to.
So going to show you how to set up DHB snooping but I've covered that once again in this video so if
you just want to see the dynamic IP inspection part of the video then jump to the specific timestamp
of interest.
I've included this once again below this video.
This presentation shows you how to set this up how to verify it on a Cisco switch.
Now the first thing we need to do is enable DHB snooping.
Now I've covered this and a lot of detail in a previous video so all I'm going to do here is copy and
paste the commands into the switch.
Have a look at this video.
If you want to look at a DHB snooping video that discusses this in a lot of detail.
Okay so what I'm gonna do is copy the commands from this presentation and paste the commands on our
switch.
Now you're not topology once again we've got a Cisco broader this rider is configured with a DHB server.
So let's view that first here's the raw data show run pipe.
Begin DHEA P that just allows me to falter the configuration until the keyword DHEA P is found so there's
the command.
Here's my DHB pull.
You can see the network used its 10 1 1 0 slash 24.
Default right or default gateway is the local router a DNS server is set to google the router has this
IP address 10 1 1 2 5 4 configured on gigabit 0.
So this interface is configured with the IP address 10 1 1 2 5 4 and the right is allocating IP addresses
to devices and we can see that by typing show IP DHB binding we can see that two devices have received
IP addresses.
This is the IP address allocated to Kelly Linux.
This is the IP address allocated to the Windows computer.
We can verify that
by using the command IP address on Kelly.
Notice there's the IP address allocated to the Kelly linux host and on the Windows computer.
I'll open up a C and D prompt IP config.
This is the IP address of the windows computer so the DHB server has been configured.
It's allocating IP addresses to the devices in the network.
What we need to do now is configure DHB snooping on the switch.
At the moment no DHB snooping has been enabled so you can see that no DCP commands have been enabled
and we haven't enabled dynamic up inspection.
Okay so the first thing I'm gonna do is copy the DHB P snooping commands to the switch
so paste those in
and you can see here that DHB snooping has been enabled globally.
It's been enabled for VLAN 1.
We've disabled option 82 and the command show IP DHB snooping shows us that to DHB snooping is now enabled
on v 1 no trusted ports have been configured yet.
Now once again I've shown you previously how to configure the HP snooping and I've explained it in a
lot of detail so I'm not doing that here.
Okay.
The next step is to configure trusted ports in mind topology gigabit 0 0 is a trusted port Okay so it
might topology gigabit.
0 0 is the interface that connects to the rotor the rotor is running the DHB service it's allocating
IP addresses we want to trust the CHP server we don't want to trust this Kelly linux host as a DHB server.
So back on the switch I'm going to paste those commands gigabit 0 0 is now a trusted interface show
IP the DHB snooping we can see that gigabit 0 0 is now a trusted interface now we can also reached a
limit DHEA P requests to stop a denial of service attack so I'm going to rate limit DCP messages to
10 packets per second on gigabit 0 1 which is the interface connecting me to the Kelly linux host again
I've explained that in a lot of detail in the previous video sold piece to that in
got to type quantity first.
So try that again.
There we go.
So show run interface gigabit 00.
We are trusting this interface.
We are not trusting this interface.
This interface gigabit 0 1 is being rate limited 0 0 is being trusted.
Okay now that I've configured DHB snooping I can configure dynamic up inspection dynamic up inspection
is fairly simple to configure what we're going to do is configure it globally on the switch by using
the command IP inspection VLAN 1 so confetti IP OPP inspection specify the VLAN my example it's v land
1 because all ports on the switch are currently configured in VLAN 1 now typically in the real world
you wouldn't put your devices and VLAN one you would put them in a different VLAN now notice what's
happening.
We are already seeing invalid OP messages received on gigabit 02.
That is the windows host.
We are not trusting anyone at the moment.
We are basically blocking all traffic.
So the windows host is trying to get it to its default gateway so it's trying to get to 10 1 1 2 5 4.
There's the IP address of the windows host Mac address of the windows host trying to get to its default
gateway and the traffic is being denied.
We can see that as an example on the windows.
P.S. If I try and ping the router it's not going to work.
Traffic is denied
and actually let me demonstrate this.
I'm going to remove dynamic OP inspection so it's removed and what you'll notice is the P.C. the windows
P.C. can ping the router but what you'll also notice is the Kelly Linux host can ping the P.C. which
we don't want it to do and it can ping the router so Kelly can ping both the windows P.C. as well as
the router but as soon as we enable dynamic up inspection we basically break the network because notice
traffic from 10 1 1 2 2 10 1 1 100 is being denied because now when we try and ping say the windows
host the traffic is denied Kelly is not able to ping the windows host and it's not able to ping its
default gateway the windows host can't get to its default gateway.
That's a problem.
We want it to be able to talk to its default gateway.
So what we're going to do is set gigabit 0 0 as a trusted port.
That's the port connecting us to the rotor.
So on the switch interface gigabit 00 IP OPP inspection just use question mark again trust we are going
to trust that interface so show run interface gigabit 00.
This command shows us that this interface is trusted for DHB snooping as well as for OP inspection so
now can the windows P.C. ping the rotor.
At the moment we can see that it can't.
We still getting a whole bunch of denies on the switch show IPD HP
snooping let's look at the bindings.
Notice the problem.
There are no D HP bindings at the moment.
We are relying on the D HP bindings database to implement dynamic OP inspection.
We need to have the bindings in the database for dynamic of inspection to work.
So we are constantly getting these denies at the moment because there is no entry in the DHB snooping
database.
So I'm going to top IP config slash release to release my IP address and then I'm going to type renew
to renew the IP address on the windows computer.
It's now being given this IP address back on the switch show IP DHB snooping binding we can see that
this mac address has been given this IP address and we can see that via DHB snooping on VLAN 1 the interface
where that host resides is gigabit 02 so back on the windows.
P.S. Can it now ping its default gateway.
And the answer is yes it can.
So remember because we're using the HP snooping the pieces have to request IP addresses and those IP
addresses have to be allocated through DHEA.
We've got to have DHB snooping listening in on the conversation seeing that to the rider allocates the
IP address to the P.C. and then because of that the DHB snooping databases bolt and dynamic up inspection
can leverage that database to permit devices.
So again on the switch show IP DHB snooping binding we can see that this IP address was allocated to
this Mac address on this interface.
Now Kelly can stall not paying the default gateway because an IP address hasn't been added to the DHB
snooping database.
So what I'm going to do is edit connections in Kelly.
I'm going to go to IP version 4 settings disable the interface
go back and get it to use DHEA P
I have config shows us that it's got its IP address
show IP DHB binding on the switch you can see that this IP address has been allocated to this mac address
which is the Kelly Lennox host MAC address ends in 5 a 0 0 which is what we see over here.
So can the Kelly Lennox host ping the default gateway.
Yes it can.
So on the switch once again show IP DHEA snooping binding.
We can see that two IP addresses have been allocated to specific MAC addresses show IP up inspection.
So there's the command again.
We can see that it's enabled for veal and one so many packets have been dropped.
Now on Kelly once again I have config shows me that this is the MAC address of the host ending in 5
a 0 0 on the switch show IP DHB snooping database that MAC address has been allocated this IP address
Kelly can paying default gateway.
Once again that IP address this MAC address I'm gonna change the MAC address by using Mac changer Mac
change it tells us that we can see the MAC address by using S. as an option and then we can create a
random MAC address using dash bar or hyphen or so Mac change the dash s Ethernet zero that's the current
mac address.
That's the permanent MAC address scrolling up once again.
That's the MAC address that we saw previously with I have config.
So let's create a random MAC address.
MAC address we've been told is now this.
So I have config shows us that that is the new mac address that we've been given random MAC address.
Can we paying the default gateway answer is no we can't
and we're seeing a lot of denies on the switch.
You can't just create some random MAC address or try and implement ops spoofing or OP poisoning because
we've now got dynamic up inspection enabled on the switch.
And I'll just stop the ping on Kelly.
The only MAC address that's allowed is that MAC address on interface gigabit 0 1.
This MAC address is permitted on gigabit 02.
So by randomly changing my mac address using Mac changer from this address to this address traffic is
now being denied it also stops someone from using an application such as a cap to poison the OP caches.
So again previously I showed you how to use it a cap to poison hosts on the network so if I try and
scan for hosts now that traffic is going to be denied by the switch because of dynamic up inspection
I can't implement of poisoning by using at a cap unlike previously when I demonstrated it in this video
because we've got a dynamic OP inspection enabled.
Okay.
Very long video once again but hopefully I've shown you clearly how to set up a dynamic of inspection
and how to test it you can once again download this presentation if you want to have a summary of what
we've done and you want to keep this as a reference.