Quanta Cloud Technology QuantaMesh QNOS5, Configuration Manual

Page: 133 / 256

133
If IPSG is disabled on the ingress port, IPSG replies that the MAC is valid. If IPSG is enabled on the ingress
port, IPSG checks the bindings database. If the MAC address is in the bindings database and the binding
matches the VLAN the frame was received on, IPSG replies that the MAC is valid. If the MAC is not in the
bindings database, IPSG informs port security that the frame is a security violation.
In the case of an IPSG violation, port security takes whatever action it normally takes upon receipt of an
unauthorized frame. Port security limits the number of MAC addresses to a configured maximum. If the
limit
n is less than the number of stations m in the bindings database, port security allows only n stations to
use the port. If n > m , port security allows only the stations in the bindings database.
4.2.3. Dynamic ARP Inspection Overview
Dynamic ARP Inspection (DAI) is a security feature that rejects invalid and malicious ARP packets. DAI prevents
a class of man-in-the-middle attacks where an unfriendly station intercepts traffic for other stations by
poisoning the ARP caches of its unsuspecting neighbors. The malicious attacker sends ARP requests or
responses mapping another station’s IP address to its own MAC address.
When DAI is enabled, the switch drops ARP packets whose sender MAC address and sender IP address do not
match an entry in the DHCP snooping bindings database. You can optionally configure additional ARP packet
validation.
When DAI is enabled on a VLAN, DAI is enabled on the interfaces (physical ports or Port-channels) that are
members of that VLAN. Individual interfaces are configured as trusted or untrusted. The trust configuration
for DAI is independent of the trust configuration for DHCP snooping.
4.2.3.1. Optional DAI Features
If you configure the MAC address validation option, DAI verifies that the sender MAC address equals the
source MAC address in the Ethernet header. There is a configurable option to verify that the target MAC
address equals the destination MAC address in the Ethernet header. This check applies only to ARP responses,
since the target MAC address is unspecified in ARP requests. You can also enable IP address checking. When
this option is enabled, DAI drops ARP packets with an invalid IP address. The following IP addresses are
considered invalid:

0.0.0.0

255.255.255.255

all IP multicast addresses

all class E addresses (240.0.0.0/4)

loopback addresses (in the range 127.0.0.0/8)
The valid IP check is applied only on the sender IP address in ARP packets. In ARP response packets, the check is
applied only on the target IP address.
4.2.4. Increasing Security with DHCP Snooping, DAI, and IPSG
DHCP Snooping, IPSG, and DAI are security features that can help protect the switch and the network against
various types of accidental or malicious attacks. It might be a good idea to enable these features on ports