42
{
ARP source suppression.
{
ARP packet source MAC consistency check.
{
ARP active acknowledgement.
{
Source MAC-based ARP attack detection.
{
Authorized ARP.
•
ARP scanning and fixed ARP.
•
The access device supports the following features:
{
ARP packet rate limit.
{
ARP gateway protection.
{
ARP filtering.
{
ARP detection.
Unresolvable IP attack protection
If a device receives a large number of unresolvable IP packets from a host, the following situations
can occur:
•
The device sends a large number of ARP requests, overloading the target subnets.
•
The device keeps trying to resolve the destination IP addresses, overloading its CPU.
To protect the device from such IP attacks, you can configure the following features:
•
ARP
source
suppression
—Stops resolving packets from a host if the number of unresolvable
IP packets from the host exceeds the upper limit within 5 seconds. The device continues ARP
resolution when the interval elapses. This feature is applicable if the attack packets have the
same source addresses.
•
ARP blackhole routing
—Creates a blackhole route destined for an unresolvable IP address.
The device drops all matching packets until the blackhole route ages out. This feature is
applicable regardless of whether the attack packets have the same source addresses.
ARP packet source MAC consistency check
This feature enables a gateway to filter out ARP packets whose source MAC address in the Ethernet
header is different from the sender MAC address in the message body. This feature allows the
gateway to learn correct ARP entries.
ARP active acknowledgement
Configure this feature on gateways to prevent user spoofing.
ARP active acknowledgement prevents a gateway from generating incorrect ARP entries.
In strict mode, a gateway performs more strict validity checks before creating an ARP entry:
•
Upon receiving an ARP request destined for the gateway, the gateway sends an ARP reply but
does not create an ARP entry.
•
Upon receiving an ARP reply, the gateway determines whether it has resolved the sender IP
address:
{
If yes, the gateway performs active acknowledgement. When the ARP reply is verified as
valid, the gateway creates an ARP entry.
{
If not, the gateway discards the packet.
Source MAC-based ARP attack detection
This feature checks the number of ARP packets delivered to the CPU. If the number of packets from
the same MAC address within 5 seconds exceeds a threshold, the device adds the MAC address to
an ARP attack entry. Before the entry is aged out, the device handles the attack by using either of the
following methods:
•
Monitor
—Only generates log messages.
