Configuring Native Bridge for MAC-IP Anti-Spoofing on VLAN Sub-Interfaces

SonicOS supports MAC-IP Anti-Spoof on VLAN sub-interfaces that are configured as Native Bridge members. Native Bridge forwards Layer 2 traffic between its member interfaces by using the Forwarding Database (FDB). For more information, refer to Configuring the Native Bridge for MAC-IP Anti-Spoofing.

This feature validates the source MAC address and IPv4 address of traffic that a Native Bridge VLAN sub-interface receives against the MAC-IP Anti-Spoof Cache. Anti-spoof enforcement on VLAN sub-interface Native Bridge members works the same way as on physical interfaces.

For example, a VLAN sub-interface such as X0.10 carries traffic for VLAN 10 and can be configured as a Native Bridge member. MAC-IP Anti-Spoof is configured per interface. It applies only to traffic received on X0.10 and does not apply to other VLAN sub-interfaces on the same physical parent interface.

Prerequisites

• The VLAN sub-interface is configured and assigned as a Native Bridge member.

• Native Bridge mode is operational with at least one host interface and one or more member interfaces.

If you turn on Layer 2 enforcement for an interface that has no static MAC-IP bindings, the firewall blocks every device on that interface. The cache for these interfaces accepts static entries only. Add the static bindings before you turn on Layer 2 enforcement.

To turn on MAC-IP Anti-Spoof on a Native Bridge VLAN sub-interface member

1. Add static MAC-IP bindings for the authorized devices. For more information, refer to Adding a Static MAC-IP Binding.

2. Navigate to NETWORK | System > MAC-IP Anti-Spoof.

3. In the Configure column, click the Edit icon for the VLAN sub-interface (for example, X0.10).

   The Edit Interface dialog box displays.

   

4. Under Anti-Spoof Settings, turn on Enable MAC-IP based anti-spoofing.

   The following options are dimmed for Native Bridge VLAN sub-interfaces:

   • Static ARP

   • DHCP Server

   • DHCP Relay

   • ARP Lock

   • ARP Watch

   • Enforce Ingress anti-spoof at Layer 3

5. Under Miscellaneous Settings:

   1. Turn on Enforce Ingress anti-spoof at Layer 2 to activate Layer 2 enforcement.

   2. Turn on Spoof Detection to log spoofed devices to the Spoof Detected List.

   3. Turn on Allow Management to allow packets that are destined for the IP address of the firewall, even from devices that are not in the cache.

   4. Turn on Allow DHCP/NetBios packets when MAC Anti-Spoof at Layer 2 is enabled to allow DHCP and NetBIOS packets from devices that are not in the cache.

6. Click Save.

For information about the log events for these interfaces, refer to the Layer 2 MAC-IP Anti-Spoof Logs topic in the SonicOS 8 Monitor Guide.