Dynamic Arp Inspection - Advantech EKI-9516P-HV User Manual

4.4.5

Dynamic ARP Inspection

Dynamic ARP Inspection (DAI) is a security feature that rejects invalid and malicious
ARP packets. DAI prevents a class of man-in-the-middle attacks, where an unfriendly
station intercepts traffic for other stations by poisoning the ARP caches of its unsus-
pecting neighbors. The miscreant sends ARP requests or responses mapping
another station's IP address to its own MAC address.
DAI relies on DHCP snooping. DHCP snooping listens to DHCP message exchanges
and builds a binding database of valid {MAC address, IP address, VLAN, and inter-
face} tuples.
When DAI is enabled, the switch drops ARP packets whose sender MAC address
and sender IP address do not match an entry in the DHCP snooping bindings data-
base. You can optionally configure additional ARP packet validation.
4.4.5.1 Global
Use the Global Configuration page to configure global DAI settings.
To access this page, click Switching > Dynamic ARP Inspection > Global.
Figure 4.181 Switching > Dynamic ARP Inspection > Global
The following table describes the items in the previous figure.
Item
Validate Source
MAC
Validate Destination
MAC
Validate IP
Submit
Refresh
Cancel
4.4.5.2 VLAN
Use the Dynamic ARP Inspection VLAN Configuration page to view and configure
Dynamic ARP Inspection (DAI) settings for VLANs. When DAI is enabled on a VLAN,
DAI is enabled on all interfaces that are members of that VLAN.
EKI-9500 Series User Manual
Description
When this option is selected, DAI verifies that the sender hardware
address in the ARP packet equals the source MAC address in the
Ethernet header. If the addresses do not match, the ARP packet is
dropped.
When this option is selected, DAI verifies that the target hardware
address in the ARP packet equals the destination MAC address in the
Ethernet header. If the addresses do not match, the ARP packet is
dropped. This check applies only to ARP responses because the tar-
get MAC address is unspecified in ARP requests.
When this option is selected, DAI drops ARP packets with an invalid IP
address. The following IP addresses are considered invalid:

0.0.0.0

255.255.255.255

All IP multicast addresses

All class E addresses (240.0.0.0/4)

Loopback addresses (in the range 127.0.0.0/8)
Click Submit to save the values and update the screen.
Click Refresh to update the screen.
Click Cancel to restore default value.
170