SMC Networks SMCGS10P-Smart User Manual

C HAPTER 4 | Configuring the Switch
Configuring Security
– 106 –
Figure 35: Configuring Static Bindings for IP Source Guard
CONFIGURING ARP
INSPECTION
ARP Inspection is a security feature that validates the MAC Address
bindings for Address Resolution Protocol packets. It provides protection
against ARP traffic with invalid MAC-to-IP address bindings, which forms
the basis for certain “man-in-the-middle” attacks. This is accomplished by
intercepting all ARP requests and responses and verifying each of these
packets before the local ARP cache is updated or the packet is forwarded to
the appropriate destination. Invalid ARP packets are dropped.
ARP Inspection determines the validity of an ARP packet based on valid
IP-to-MAC address bindings stored in a trusted database – the DHCP
snooping binding database (see "Configuring DHCP Snooping"). This
database is built by DHCP snooping if it is enabled globally on the switch
and on the required ports. ARP Inspection can also validate ARP packets
against statically configured addresses.
COMMAND USAGE
Enabling & Disabling ARP Inspection
◆ ARP Inspection is controlled on a global and port basis.
◆ By default, ARP Inspection is disabled both globally and on all ports.
■
If ARP Inspection is globally enabled, then it becomes active only on
the ports where it has been enabled.
■
When ARP Inspection is enabled globally, all ARP request and reply
packets on inspection-enabled ports are redirected to the CPU and
their switching behavior handled by the ARP Inspection engine.
■
If ARP Inspection is disabled globally, then it becomes inactive for
all ports, including those where inspection is enabled.
■
When ARP Inspection is disabled, all ARP request and reply packets
will bypass the ARP Inspection engine and their switching behavior
will match that of all other packets.
■
Disabling and then re-enabling global ARP Inspection will not affect
the ARP Inspection configuration of any ports.
■
When ARP Inspection is disabled globally, it is still possible to
configure ARP Inspection for individual ports. These configuration

SMC Networks SMCGS10P-Smart Specifications

General

Brand	SMC Networks
Model	SMCGS10P-Smart
Category	Switch
Language	English