AMX NXA-ENET8-POE+, Instruction Manual, Page: 167 / 283

Security Measures
167
Instruction Manual - NXA-ENET8-POE+
ARP Inspection
ARP Inspection is a security feature that validates the MAC Address bindings for Address Resolution Protocol packets. It provides
protection against ARP traffic with invalid MAC-to-IP address bindings, which forms the basis for certain "man-in-the-middle"
attacks. This is accomplished by intercepting all ARP requests and responses and verifying each of these packets before the local
ARP cache is updated or the packet is forwarded to the appropriate destination. Invalid ARP packets are dropped.
ARP Inspection determines the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a trusted database -
the DHCP snooping binding database (see the DHCP Snooping Global Configuration section on page 178 for more information).
This database is built by DHCP snooping if it is enabled on globally on the switch and on the required VLANs. ARP Inspection can
also validate ARP packets against user- configured ARP access control lists (ACLs) for hosts with statically configured addresses
(see the Configuring an ARP ACL section on page 164).
Command Usage
Enabling & Disabling ARP Inspection

ARP Inspection is controlled on a global and VLAN basis.

By default, ARP Inspection is disabled both globally and on all VLANs.

If ARP Inspection is globally enabled, then it becomes active only on the VLANs where it has been enabled.

When ARP Inspection is enabled globally, all ARP request and reply packets on inspection-enabled VLANs are redirected
to the CPU and their switching behavior handled by the ARP Inspection engine.

If ARP Inspection is disabled globally, then it becomes inactive for all VLANs, including those where inspection is
enabled.

When ARP Inspection is disabled, all ARP request and reply packets will bypass the ARP Inspection engine and their
switching behavior will match that of all other packets.

Disabling and then re-enabling global ARP Inspection will not affect the ARP Inspection configuration of any VLANs.

When ARP Inspection is disabled globally, it is still possible to configure ARP Inspection for individual VLANs. These
configuration changes will only become active after ARP Inspection is enabled globally again.

The ARP Inspection engine in the current firmware version does not support ARP Inspection on trunk ports.
Configuring Global Settings for ARP Inspection
Use the Security > ARP Inspection (Configure General) page to enable ARP inspection globally for the switch, to validate address
information in each packet, and configure logging.
Command Usage
ARP Inspection Validation

By default, ARP Inspection Validation is disabled.

Specifying at least one of the following validations enables ARP Inspection Validation globally. Any combination of the
following checks can be active concurrently.

Destination MAC - Checks the destination MAC address in the Ethernet header against the target MAC address in the
ARP body. This check is performed for ARP responses. When enabled, packets with different MAC addresses are
classified as invalid and are dropped.

IP - Checks the ARP body for invalid and unexpected IP addresses. These addresses include 0.0.0.0, 255.255.255.255,
and all IP multicast addresses. Sender IP addresses are checked in all ARP requests and responses, while target IP
addresses are checked only in ARP responses.

Source MAC - Checks the source MAC address in the Ethernet header against the sender MAC address in the ARP body.
This check is performed on both ARP requests and responses. When enabled, packets with different MAC addresses are
classified as invalid and are dropped.
ARP Inspection Logging

By default, logging is active for ARP Inspection, and cannot be disabled.

The administrator can configure the log facility rate.

When the switch drops a packet, it places an entry in the log buffer, then generates a system message on a rate-controlled
basis. After the system message is generated, the entry is cleared from the log buffer.

Each log entry contains flow information, such as the receiving VLAN, the port number, the source and destination IP
addresses, and the source and destination MAC addresses.

If multiple, identical invalid ARP packets are received consecutively on the same VLAN, then the logging facility will only
generate one entry in the log buffer and one corresponding system message.

If the log buffer is full, the oldest entry will be replaced with the newest entry.