beautypg.com

Arp inspection, Figure 191: binding a port to an acl, Arp i – LevelOne GTL-2691 User Manual

Page 370

background image

C

HAPTER

13

| Security Measures

ARP Inspection

– 370 –

W

EB

I

NTERFACE

To bind an ACL to a port:

1.

Click Security, ACL.

2.

Select Configure Interface from the Step list.

3.

Select IP or MAC from the Type list.

4.

Select the name of an ACL from the ACL list.

5.

Click Apply.

Figure 191: Binding a Port to an ACL

ARP I

NSPECTION

ARP Inspection is a security feature that validates the MAC Address

bindings for Address Resolution Protocol packets. It provides protection

against ARP traffic with invalid MAC-to-IP address bindings, which forms

the basis for certain “man-in-the-middle” attacks. This is accomplished by

intercepting all ARP requests and responses and verifying each of these

packets before the local ARP cache is updated or the packet is forwarded to

the appropriate destination. Invalid ARP packets are dropped.

ARP Inspection determines the validity of an ARP packet based on valid

IP-to-MAC address bindings stored in a trusted database – the DHCP

snooping binding database (see

"DHCP Snooping Configuration" on

page 399

). This database is built by DHCP snooping if it is enabled on

globally on the switch and on the required VLANs. ARP Inspection can also

validate ARP packets against user-configured ARP access control lists

(ACLs) for hosts with statically configured addresses (see

"Configuring an

ARP ACL" on page 367

).