An on-path attack is a type of attack where an attacker intercepts and modifies the traffic between two devices on the same network. One common example of an on-path attack is ARP poisoning, where an attacker sends fake ARP replies to trick the devices into sending their traffic to the attacker instead of the intended destination. This allows the attacker to eavesdrop, alter, or redirect the traffic.
To mitigate this threat, one of the best practices is to use dynamic ARP inspection (DAI), which is a security feature that validates ARP packets on a network. DAI checks the MAC address and IP address bindings in the ARP packets against a trusted database, such as the DHCP snooping table or a static ARP access list. If the ARP packet contains an invalid or spoofed binding, DAI drops the packet and prevents the ARP poisoning attack.
The other options are not as effective as DAI for mitigating on-path attacks. Role-based access is a method of controlling access to resources based on the roles and permissions of the users, but it does not prevent an attacker from spoofing the MAC address or IP address of a legitimate user. Control plane policing is a feature that protects the control plane of a router or switch from excessive or malicious traffic, but it does not verify the MAC address or IP address bindings in the data plane. MAC filtering is a feature that allows or denies access to a network based on the MAC address of the device, but it does not prevent an attacker from spoofing the MAC address of an allowed device.
Reference:
https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/on-path-attacks/
https://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/cpp.html