4IPNET EAP210, User Manual

Page: 115 / 166

User’s Manual
Enterprise Access Point ENGLISH
Copyright © 4IPNET, INC. All rights reserved.
114
7.3.3 Advanced
At Firewall > Advanced, more advanced settings on firewall rules can be configured, providing extra security
enhancement against DHCP and ARP traffic traversing the available interfaces of the system.

Trust Interface : Each VAP interface can be checked individually to mark as trusted interfaces;
security enforcements on DHCP/ARP like DHCP snooping and ARP inspection will be carried out on
non-trusted interfaces.

DHCP Snooping : When enabled, DHCP packets will be validated against possible threats like
DHCP starvation attack; in addition, the trusted DHCP server (IP/MAC) can be specified to prevent
rouge DHCP server.

ARP Inspection : When enabled, ARP packets will be validated against ARP spoofing.
o
Proxy ARP option when enabled, AP will reply ARP requests on behalf of downlink
stations. The ARP table maintained by the AP will be used as a look up table upon receipt
of ARP request from AP uplink. Adversely, without Proxy ARP, ARP request is
broadcasted down into the AP
’s wireless network causing network inefficiencies.
o
Force DHCP option when enabled, the AP only learns MAC/IP pair information through
DHCP packets. Since devices configured with static IP address does not send DHCP
traffic, any clients with static IP address will be blocked from internet access unless its
MAC/IP pair is listed and enabled on the Static Trust List.
o
Trust List Broadcast can be enabled to let other APs (with L2 firewall feature) learn the
trusted MAC/IP pairs to issue ARP requests.
o
Static Trust List can be used to add MAC or MAC/IP pairs of devices that are trusted to
issue ARP request. Other network nodes can still send their ARP requests; however, if
their IP appears on the static list (with different MAC), their ARP requests will be dropped
to prevent eavesdropping.

RF Isolation (between RFs) : Clients are isolated between RF Card A and RF Card B.

VAP Isolation (within RF) : Clients on different VAPs on the same RF Card are isolated.
If any settings are changed, please click SAVE to save the configuration before leaving this page.

Note:
- RF Isolation (between RFs) may be limited on selected AP models.
- VAP Isolation (within RF) may be limited on selected AP model.