SonicOS 8 System Administration Guide

Technical Documentation>  MAC-IP Anti-Spoof>  Layer Two Bridge for MAC-IP Anti-Spoofing
Table of Contents

Layer Two Bridge for MAC-IP Anti-Spoofing

In Layer 2 bridge deployments, the firewall operates as a transparent bridge, forwarding frames between bridge ports while it applies security policies. Without MAC-IP Anti-Spoof enforcement, an attacker on the same Layer 2 segment can use Address Resolution Protocol (ARP) poisoning to redirect traffic between legitimate devices through a host that the attacker controls. ARP maps IP addresses to MAC addresses, and ARP poisoning corrupts that mapping.

MAC-IP Anti-Spoof enforcement is supported on Layer 2 Bridged Mode (L2B) interfaces and Native Bridge VLAN sub-interface members. When MAC-IP Anti-Spoof is turned on for an L2B interface, the firewall validates every ingress frame on that interface against the MAC-IP Anti-Spoof Cache before it forwards the frame to the bridge partner port. The firewall drops a frame if the source MAC address is not in the cache.

Supported interface types:

  • Layer 2 Bridged Mode (L2B) interfaces — physical bridge port pairs (for example, X0 and X1 paired as a bridge)

  • Native Bridge VLAN sub-interface members — VLAN sub-interfaces (for example, X0.10) that are assigned as Native Bridge members

The MAC-IP Anti-Spoof Cache for these interface types accepts static entries only. For more information, refer to Anti-Spoof Cache. The Static ARP, DHCP Server, and DHCP Relay options are dimmed in the interface.

Enforcement on L2B is per port and independent. You can configure each bridge port (for example, X0 and X1) with its own settings and cache entries. Each VLAN sub-interface (for example, X0.10 and X0.20) is also configured and enforced independently, even when both are hosted on the same physical parent port.

If you turn on Layer 2 enforcement for an interface that has no static MAC-IP bindings, the firewall blocks every device on that interface. Add the static bindings before you turn on Layer 2 enforcement.

To configure MAC-IP Anti-Spoof on a Layer 2 Bridged Mode interface

  1. Navigate to NETWORK | System > Interfaces and confirm that the interface mode is Layer 2 Bridged Mode.

  2. Navigate to NETWORK | System > MAC-IP Anti-Spoof.

  3. Add static MAC-IP bindings for the authorized devices on the bridge port. For more information, refer to Anti-Spoof Cache.

  4. In the Configure column, click the Edit icon for the bridge port (for example, X0).

    The Edit Interface dialog box displays.

  5. Under Anti-Spoof Settings, turn on Enable MAC-IP based anti-spoofing.

  6. Under Miscellaneous Settings, turn on Enforce Ingress anti-spoof at Layer 2.

  7. (Optional) Turn on Spoof Detection, Allow Management, or Allow DHCP/NetBios packets when MAC Anti-Spoof at Layer 2 is enabled.

  8. Click Save.

  9. Repeat steps 3 to 8 for the second bridge port (for example, X1).