44
If you only enable ARP detection for a VLAN, ARP detection provides only the user validity
check.
Upon receiving an ARP packet from an ARP untrusted interface, the device matches the
sender IP and MAC addresses with the following entries:
{
Static IP source guard binding entries.
{
DHCP snooping entries.
If a match is found, the ARP packet is considered valid and is forwarded. If no match is found,
the ARP packet is considered invalid and is discarded.
•
ARP packet validity check
Enable validity check for ARP packets received on untrusted ports and specify the following
objects to be checked:
{
Sender MAC
—Checks whether the sender MAC address in the message body is identical
to the source MAC address in the Ethernet header. If they are identical, the packet is
forwarded. Otherwise, the packet is discarded.
{
Target MAC
—Checks the target MAC address of ARP replies. If the target MAC address is
all-zero, all-one, or inconsistent with the destination MAC address in the Ethernet header,
the packet is considered invalid and discarded.
{
IP
—Checks the sender and target IP addresses of ARP replies, and the sender IP address
of ARP requests. All-one or multicast IP addresses are considered invalid and the
corresponding packets are discarded.
•
ARP restricted forwarding
ARP restricted forwarding controls the forwarding of ARP packets that are received on
untrusted interfaces and have passed user validity check as follows:
{
If the packets are ARP requests, they are forwarded through the trusted interface.
{
If the packets are ARP replies, they are forwarded according to their destination MAC
address. If no match is found in the MAC address table, they are forwarded through the
trusted interface.
ARP does not have security mechanisms and is vulnerable to network attacks. To protect the
network from ARP attacks, the device provides the ARP scanning and fixed ARP features.
ARP scanning is typically used together with the fixed ARP feature in small-scale networks.
ARP scanning automatically creates ARP entries for devices in an address range. The device
performs ARP scanning in the following steps:
1.
Sends ARP requests for each IP address in the address range.
2.
Obtains their MAC addresses through received ARP replies.
3.
Creates dynamic ARP entries.
Fixed ARP converts existing dynamic ARP entries (including those generated through ARP scanning)
to static ARP entries. This feature prevents ARP entries from being modified by attackers.
DNS
Domain Name System (DNS) is a distributed database used by TCP/IP applications to translate
domain names into IP addresses. IPv4 DNS translates domain names into IPv4 addresses. IPv6
DNS translates domain names into IPv6 addresses. The domain name-to-IP address mapping is
called a DNS entry.
Dynamic domain name resolution
To use dynamic domain name resolution, you must specify a DNS server address for a device. The
device sends DNS queries to the DNS server for domain name resolution.
