Is it possible to enable ARP spoofing in Azure virtual networks?

Question

Is it possible to enable ARP spoofing in Azure virtual networks?

David Formby 20

I am interested in hosting penetration testing labs in Azure and would like to be able to use ARP spoofing. I understand that it is not possible to do ARP spoofing in most cloud providers, like AWS (https://medium.com/cloud-security/why-one-of-your-favorite-pen-testing-techniques-doesnt-work-on-aws-4974d9294e65) I've searched around the documentation and the configurations in the Azure portal, but I don't see any way of controlling it. I'm guessing the answer is probably no, but does anyone know if it is possible to enable ARP spoofing inside of an Azure virtual network?

KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2024-02-02T12:49:34.7+00:00

@David Formby

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you would like to know if ARP spoofing is possible in Azure VNETs.

As stated by Priya Kumar , ARP is implemented differently in a SDN platform.

And as such, you will not be able to use ARP Spoofing.

Please let us know if we can be of any further assistance here.

Thanks, Kapil

Please **Accept an answer **if correct. Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2024-02-12T05:26:12.54+00:00

@David Formby

Just checking in to see if the answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Accepted answer

0 additional answers

Your answer

KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2024-02-02T12:49:34.7+00:00

@David Formby

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you would like to know if ARP spoofing is possible in Azure VNETs.

As stated by Priya Kumar , ARP is implemented differently in a SDN platform.

And as such, you will not be able to use ARP Spoofing.

Please let us know if we can be of any further assistance here.

Thanks, Kapil

Please **Accept an answer **if correct. Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2024-02-12T05:26:12.54+00:00

@David Formby

Just checking in to see if the answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil

Answer 1

Priya Kumar 1,096 Microsoft Employee

Hello David,

Thanks for reaching to Azure Q and A platform.

The answer to the above query like other cloud providers is likely to be NO. Because of the following reasons.

ARP in azure is a Software Defined Networking. It has its own consideration compared to the Traditional LAN.
ARP request would need to push to every single TOR and every Node in the datacenter.
The agents running on the node, would recognize the destination MAC and pulls the ARP request to see if that IP is part of the VNET.
I do believe that any Spoofing of the ARP or the MAC spoofing is not recommended to perform for this flow.

Could you please explain us more on why you need ARP spoofing? So that we could suggest any alternative security feature in Azure.

Regards, Priya Kumar

David Formby 20 Reputation points

2024-02-02T13:35:53.0633333+00:00

Hi Priya,
Thanks for the detailed answer!

To clarify our need, we would like to replicate a physical LAN (including Layer 2 ARP) in the cloud to allow users to practice the same kinds of penetration testing techniques (like ARP spoofing) that they would in a real LAN.

The secondary need is that we would like to do this "elastically", only incurring costs when actively being used. I appreciate any alternatives!
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2024-02-09T04:34:37.5166667+00:00

David Formby ,

Azure Platform does not support ARP Spoofing with Virtual Networks.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Share via

Is it possible to enable ARP spoofing in Azure virtual networks?

0 additional answers

Your answer