SonicOS 8 System Administration Guide
Table of Contents
MAC-IP Anti-Spoof
MAC and IP address-based attacks are increasingly common in today’s network security environment. These types of attacks often target a Local Area Network (LAN) and can originate from either outside or inside a network. In fact, anywhere internal LANs are somewhat exposed, such as in office conference rooms, schools, or libraries, could provide an opening to these types of attacks. These attacks also go by various names, such as man-in-the-middle attacks, Address Resolution Protocol (ARP) poisoning, and SPITS. The MAC-IP Anti-Spoof feature reduces the risk of these attacks. It provides different ways to control access to a network and blocks spoofed traffic at OSI Layers 2 and 3.
SonicOS supports MAC-IP Anti-Spoof enforcement on the following interface types:
-
Layer 3 interfaces — Standard Layer 3 anti-spoof enforcement (IPv4 and IPv6).
-
Layer 2 Bridged Mode (L2B) interfaces — Layer 2 enforcement on L2B bridge-pair members.
-
Native Bridge physical member interfaces — Layer 2 enforcement on physical Native Bridge members.
-
Native Bridge VLAN sub-interface members — Layer 2 enforcement on VLAN sub-interfaces that operate as Native Bridge members.
MAC-IP Anti-Spoof for Native Bridge VLAN sub-interface members is supported on TZ Series and NSa Series platforms. These members support IPv4 only.
The effectiveness of the MAC-IP Anti-Spoof feature focuses on two areas. The first is admission control that allows you the ability to select which devices gain access to the network. The second area is the elimination of spoofing attacks, such as denial-of-service attacks, at Layer 2. To achieve these goals, two caches of information must be built: the MAC-IP Anti-Spoof Cache, and the ARP Cache.
The MAC-IP Anti-Spoof cache validates incoming packets and determines whether they are to be allowed inside the network. An incoming packet’s source MAC and IP addresses are looked up in this cache. If they are found, the packet is allowed through. The MAC-IP Anti-Spoof cache is built through one or more of the following sub-systems:
- DHCP Server-based leases (SonicWall’s - DHCP Server)
- DHCP relay-based leases (SonicWall’s - IP Helper)
- Static ARP entries
- User created static entries
The ARP Cache is built through the following subsystems:
- ARP packets; both ARP requests and responses
- Static ARP entries from user-created entries
- MAC-IP Anti-Spoof Cache
The MAC-IP Anti-Spoof subsystem achieves egress control by locking the ARP cache, so egress packets (packets exiting the network) are not spoofed by a bad device or by unwanted ARP packets. This prevents a firewall from routing a packet to the unintended device, based on mapping. This also prevents man-in-the-middle attacks by refreshing a client’s own MAC address inside its ARP cache.