Arp Inspection - WAGO 852-1305 Manual

WAGO-ETHERNET-Zubehör 852
852-1305 8/4-Port 100BASE-T/1000BASE-SX/LX
7.3.1.3

ARP Inspection

The dynamic "ARP Inspection" ("Address Resolution Protocol Inspection") is a
security function in which ARP packets are inspected in a network. Dynamic ARP
inspections validates the packet by performing IP-to-MAC address binding
inspection stored in a trusted database (the "DHCP Snooping" database) before
forwarding the packet. Dynamic ARP intercepts, logs, and discards ARP packets
with invalid IP-to-MAC address bindings. This function protects the network
from certain "Man-in-the-Middle" attacks.
Dynamic ARP inspection ensures that only valid ARP requests and responses are
relayed.
The switch executes the following processes:
• Interception of all ARP requests and responses on untrusted ports.
• Inspection of all intercepted packets for valid IP-to-MAC address binding
before updating the local ARP cache or forwarding a packet to the
respective destination.
Trusted Port and Untrusted Port
• This setting is independent of the "Trusted/Untrusted" setting for "DHCP
Snooping".
• The switch does not drop ARP packets from "Trusted Ports" for any reason.
• The switch drops ARP packets from "Untrusted Ports" if the information
from the sender in the ARP packets does not match any current bindings.
• Normally, the "Trusted Ports" are the "Uplink Ports" and the "Untrusted
Ports" are connected to subscribers.
Configurations
Users can enable/disable the ARP Inspection on the switch. It can also be
enabled/disabled on a specific VLAN. If ARP Inspection is disabled on the
switch, ARP Inspection is disabled on all VLANs, even if enabled for individual
VLAN.
Global State/VLAN State
There is a global state and individual VLAN states.
If the global state is disabled, ARP Inspection is disabled on the switch, even if
individual VLAN states are enabled.
If the global state for ARP Inspection is enabled, this function must be enabled by
the user for specific VLANs.
Manual
1.1.0
Enhanced Features 99