43
•
Filter
—Generates log messages and filters out subsequent ARP packets from that MAC
address.
You can exclude the MAC addresses of some gateways and servers from this detection. This feature
does not inspect ARP packets from those devices even if they are attackers.
Authorized ARP
Authorized ARP entries are generated based on the DHCP clients' address leases on the DHCP
server or dynamic client entries on the DHCP relay agent.
With authorized ARP enabled, an interface is disabled from learning dynamic ARP entries. This
feature prevents user spoofing and allows only authorized clients to access network resources.
ARP scanning and fixed ARP
ARP scanning is typically used together with the fixed ARP feature in small-scale networks.
ARP scanning automatically creates ARP entries for devices in an address range. The device
performs ARP scanning using the following steps:
1.
Sends ARP requests for each IP address in the address range.
2.
Obtains their MAC addresses through received ARP replies.
3.
Creates dynamic ARP entries.
Fixed ARP converts existing dynamic ARP entries (including those generated through ARP scanning)
to static ARP entries. This feature prevents ARP entries from being modified by attackers.
ARP packet rate limit
The ARP packet rate limit feature allows you to limit the rate of ARP packets delivered to the CPU.
An ARP detection enabled device will send all received ARP packets to the CPU for inspection.
Processing excessive ARP packets will make the device malfunction or even crash. To solve this
problem, configure the ARP packet rate limit.
Configure this feature when ARP detection is enabled, or when ARP flood attacks are detected.
If logging for ARP packet rate limit is enabled, the device sends the highest threshold-crossed ARP
packet rate within the sending interval in a log message to the information center. You can configure
the information center module to set the log output rules.
ARP gateway protection
Configure this feature on interfaces not connected with a gateway to prevent gateway spoofing
attacks.
When such an interface receives an ARP packet, it checks whether the sender IP address in the
packet is consistent with that of any protected gateway. If yes, it discards the packet. If not, it handles
the packet correctly.
ARP filtering
The ARP filtering feature can prevent gateway spoofing and user spoofing attacks.
An interface enabled with this feature checks the sender IP and MAC addresses in a received ARP
packet against permitted entries. If a match is found, the packet is handled correctly. If not, the
packet is discarded.
ARP detection
ARP detection enables access devices to block ARP packets from unauthorized clients to prevent
user spoofing and gateway spoofing attacks. ARP detection does not check ARP packets received
from ARP trusted ports.
ARP detection provides the following functions:
•
User validity check
