Arp Inspection - Edge-Core ECS4810-12M Layer 2 Management Manual

ARP I
NSPECTION
W I
EB NTERFACE
To bind an ACL to a port:
Click Security, ACL.
1.
Select Configure Interface from the Step list.
2.
Select IP or MAC from the Type list.
3.
Select a port.
4.
Select the name of an ACL from the ACL list.
5.
Click Apply.
6.
Figure 187: Binding a Port to an ACL
ARP Inspection is a security feature that validates the MAC Address
bindings for Address Resolution Protocol packets. It provides protection
against ARP traffic with invalid MAC-to-IP address bindings, which forms
the basis for certain "man-in-the-middle" attacks. This is accomplished by
intercepting all ARP requests and responses and verifying each of these
packets before the local ARP cache is updated or the packet is forwarded to
the appropriate destination. Invalid ARP packets are dropped.
ARP Inspection determines the validity of an ARP packet based on valid
IP-to-MAC address bindings stored in a trusted database – the DHCP
snooping binding database (see
page 373). This database is built by DHCP snooping if it is enabled on
globally on the switch and on the required VLANs. ARP Inspection can also
validate ARP packets against user-configured ARP access control lists
– 341 –
C 14
HAPTER
"DHCP Snooping Configuration" on
| Security Measures

ARP Inspection