SonicOS 8 System Administration Guide

Technical Documentation>  MAC-IP Anti-Spoof>  Anti-Spoof Cache
Table of Contents

Anti-Spoof Cache

The MAC-IP Anti-Spoof Cache lists the devices that are authorized to access the network and the devices that are blocked.

To add a device to the list

  1. Navigate to the NETWORK | System > MAC-IP Anti-Spoof page.
  2. Click +Add. The Add Anti-Spoof Cache dialog box displays.

    3. Add Anti-Spoof Cache

  1. From the Interface drop-down menu, select an interface. For Native Bridge members, select the Native Bridge member interface.
  2. Enter the IP address for the device in the IP Address field.
  3. Enter the MAC address for the device in the MAC Address field.
  4. Select A Router to allow traffic from devices behind this device.
  5. Select A blacklisted device to block packets from this device regardless of its IP address.
  6. Click Save.

When adding Anti-Spoof Cache entries for Native Bridge VLAN sub-interface or L2B interfaces, an entry is identified by the interface and the MAC address together. The same MAC address can have different entries on different Native Bridge member interfaces.

For Native Bridge and L2B interfaces, the Anti-Spoof Cache can only be populated via static entries (manually or via CLI). The auto-population methods (DHCP Server, DHCP Relay, Static ARP) are not available for these interface types.

Unlike Layer 3 MAC-IP Anti-Spoof, Layer 2 enforcement blocks DHCP and NetBIOS packets by default. If DHCP-dependent devices exist on a Native Bridge member or L2B interface, you must either:

  • Add static entries for those devices to the Anti-Spoof Cache, or
  • Turn on Allow DHCP/NetBios packets when MAC Anti-Spoof at Layer 2 is enabled for that interface.

If you need to edit an Anti-Spoof cache entry, click the entry’s Edit icon under the Configure column.

To delete one or more cache entries, select the check box for each entry and click Delete.

To clear cache statistics

  1. Select the desired devices, then click Reset.

Some packet types are bypassed even though the MAC-IP Anti-Spoof feature is enabled:

  • Non-IP packets.
  • DHCP packets with source IP address 0.0.0.0.
  • Packets from a VPN tunnel.
  • Packets with invalid Unicast IPs as their source IPs.
  • Packets from interfaces on which Allow Management is not turned on.

The Anti-Spoof Cache Search section provides the ability to search the entries in the cache.

To search the MAC-IP Anti-Spoof Cache

  1. Navigate to the NETWORK | System > MAC-IP Anti-Spoof page.
  2. Enter a search string in the field.
  3. Click Search. Matching entries in the MAC-IP Anti-Spoof cache are displayed.

To clear the Anti-Spoof Cache table and redisplay all entries, click Refresh.