Configuring Arp Attack Protection; Overview; User Validity Check; Arp Packet Validity Check - HP 1910 User Manual

Configuring ARP attack protection

Overview

Although ARP is easy to implement, it provides no security mechanism and thus is vulnerable to network
attacks. The ARP detection feature enables access devices to block ARP packets from unauthorized clients
to prevent user spoofing and gateway spoofing attacks.
ARP detection provides user validity check and ARP packet validity check.

User validity check

This feature does not check ARP packets received from ARP trusted ports, but it checks an ARP packets
from ARP untrusted ports.
Upon receiving an ARP packet from an ARP untrusted interface, this feature compares the sender IP and
MAC addresses of the ARP packet against the DHCP snooping entries, 802.1X security entries, and OUI
MAC addresses.
If a match is found from those entries, the ARP packet is considered valid and is forwarded. If the sender
MAC address of the received ARP packet is an OUI MAC address, the packet is considered valid.
If no match is found, the ARP packet is considered invalid and is discarded.

ARP packet validity check

This feature does not check ARP packets received from ARP trusted ports. It checks ARP packets received
from ARP untrusted ports based on the following objects:
src-mac—Checks whether the sender MAC address in the message body is identical to the source
•
MAC address in the Ethernet header. If they are identical, the packet is forwarded; otherwise, the
packet is discarded.
dst-mac—Checks the target MAC address of ARP replies. If the target MAC address is all-zero,
•
all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is
considered invalid and discarded.
• ip—Checks the sender and target IP addresses of ARP replies, and the sender IP address of ARP
requests. All-one or multicast IP addresses are considered invalid and the corresponding packets
are discarded.

Configuring ARP detection

To check user validity, at least one among the DHCP snooping entries or 802.1X security entries is
available. Otherwise, all ARP packets received from ARP untrusted ports are discarded, except for the
ARP packets with an OUI MAC address as the sender MAC address when voice VLAN is enabled.
1. From the navigation tree, select Network > ARP Anti-Attack.
The ARP detection configuration page appears.
272