Network Administration: Security
259
FILE LOCATION: C:\Users\gina\Desktop\Checkout_new\Dell Astute\User
Guide\Dell_Astute_Network_Admin_Security.fm
D E L L CO N F I D E N T I A L – P R E L I M I N A RY 8 / 9 / 16 - F O R P RO O F O N L Y
pages). If the packet’s IP address was not found in the ARP Inspection
List, and DHCP Snooping is enabled for a VLAN, a search of the DHCP
Snooping database is performed.
See
for an explanation of the DHCP Snooping database. If
the IP address is found the packet is valid, and is forwarded.
Packets with invalid ARP Inspection bindings are logged and dropped.
Ports are classified as follows:
• Trusted — Packets are not inspected.
• Untrusted —Packets are inspected as described above.
The following additional validation checks may be configured by the user:
• Source MAC — Compares the packet’s source MAC address in the
Ethernet header against the sender’s MAC address in the ARP request.
This check is performed on both ARP requests and responses.
• Destination MAC — Compares the packet’s destination MAC address in
the Ethernet header against the destination interface’s MAC address. This
check is performed for ARP responses.
• IP Addresses — Compares the ARP body for invalid and unexpected IP
addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP Multicast
addresses.
Global Settings
To enable ARP inspection on the device:
1
Click
Network Administration > Security
>
Dynamic ARP Inspection
(DAI)
>
Global Settings
.
2
Enter the fields:
•
Enable ARP Inspection
— Enable/disable ARP inspection.
•
ARP Inspection Validate
— Enable/disable the following checking
source MAC address, destination MAC address and IP addresses
against the respective addresses in the ARP body.
•
Minimal Syslog Interval (0 – 86400)
— Enter the minimum time
interval between successive ARP SYSLOG messages.
