Chapter 24 Arp Guard Configuration; Introduction To Arp Guard - Planet XGS3-42000R User Manual

Chapter 24 ARP GUARD Configuration

24.1 Introduction to ARP GUARD

There is serious security vulnerability in the design of ARP protocol, which is any network device, can send
ARP messages to advertise the mapping relationship between IP address and MAC address. This provides a
chance for ARP cheating. Attackers can send ARP REQUEST messages or ARP REPLY messages to
advertise a wrong mapping relationship between IP address and MAC address, causing problems in network
communication. The danger of ARP cheating has two forms: 1. PC4 sends an A RP message to advertise that
the IP address of PC2 is mapped to the MAC address of PC4, which will cause all the IP messages to PC2
will be sent to PC4, thus PC4 will be able to monitor and capture the messages to PC2; 2. PC4 sends ARP
messages to advertise that the IP address of PC2 is mapped to an illegal MAC address, which will prevent
PC2 from receiving the messages to it. Particularly, if the attacker pretends to be the gateway and do ARP
cheating, the whole net work will be collapsed.
We utilize the filtering entries of the switch to protect the ARP entries of important net work devic es from being
imitated by other devices. The basic theory of doing this is that utilizing the filtering entries of the switch to
check all the ARP messages entering through the port, if the source address of the A RP message is protected,
the messages will be directly dropped and will not be forwarded.
ARP GUARD function is usually used to protect the gateway from being attacked. If all the accessed PCs in
the network should be protected from A RP cheating, then a large number of ARP GUARD address should be
configured on the port, which will take up a big part of FFP entries in the chip, and as a result, might affect
other applications. So this will be improper. It is recommended that adopting FREE RESOURCE related
accessing scheme. Please refer to relative documents for details.
PC1
PC2
PC3
Figure 24-1-1 A RP GUARD schematic diagram
HUB A B C
PC4 PC5
24-1
Switch
D
PC6