Figure 10-2 Principles Of Dynamic Arp Inspection - Raisecom ISCOM2600G-HI (A) Series Configuration Manual

Raisecom
ISCOM2600G-HI (A) Series Configuration Guide
There are 2 modes for dynamic ARP inspection:


The ARP inspection table, which is used for preventing ARP attacks, consists of DHCP
snooping entries and statically configured ARP inspection rules, including IP address, MAC
address, and VLAN binding information. In addition, the ARP inspection table associates this
information with specific interfaces. The dynamic ARP inspection binding table supports the
combination of following entries:




Dynamic ARP inspection interfaces are divided into the following two types according to trust
status:



Figure 10-2 Principles of dynamic ARP inspection

Figure 10-2 shows principles of dynamic ARP inspection. When the ISCOM2600G-HI series
switch receives an ARP packet, it compares the source IP address, source MAC address,
interface number, and VLAN information of the ARP packet with the DHCP Snooping entry
information. If matched, it indicates that it is a legal user and the ARP packets are permitted to
pass. Otherwise, it is an ARP attack and the ARP packet is discarded.
Dynamic ARP inspection also provides rate limiting on ARP packets to prevent unauthorized
users from attacking the ISCOM2600G-HI series switch by sending a large number of ARP
packets to the ISCOM2600G-HI series switch.

Static binding mode: configure the binding manually.
Dynamic binding mode: in cooperation with the DHCP snooping to generate dynamic
binding. When DHCP Snooping entry is changed, the dynamic ARP inspection will also
update dynamic binding entry synchronously.
Interface+IP
Interface+IP+MAC
Interface+IP+VLAN
Interface+IP+MAC+VLAN
Trusted interface: the interface will stop ARP inspection, which conducts no ARP
protection on the interface. All ARP packets are allowed to pass.
Untrusted interface: the interface takes ARP protection. Only ARP packets that match the
binding table rules are allowed to pass. Otherwise, they are discarded.
When the number of ARP packets received by an interface per second exceeds the
threshold, the system will determine that the interface encounters ARP attacks, and then
discard all received ARP packets to avoid ARP attacks.
Raisecom Proprietary and Confidential
Copyright © Raisecom Technology Co., Ltd.
10 Security
411