ExtremeWireless (WiNG)

Expand all | Collapse all

ARP CACHE POISONING

  • 1.  ARP CACHE POISONING

    Posted 12-09-2017 15:39
    Hello Community,

    I use ip mac conflict log only. AP75XX/AP65XX. WING 5.8.6+/5.9+.
    Recently, in several deployments I saw a lot of this type of logs messages:

    ...%DATAPLANE-4-ARPPOISON: ARP CACHE POISONING: Conflicting snoop entry found :Ethernet Src Mac: ....., Ethernet Dst Mac: FF-FF-FF-FF-FF-FF, ARP Src Mac: ...., ARP Dst Mac: 00-00-00-00-00-00, ARP Src IP: ...., ARP Target IP: ...., Snoop Table MAC = ...., Snoop Table IP = ....

    It seems the router is flooding some different info about mac adress table info with AP.
    Can it cause any network issues ?

    Thanks,

    Aviv Kedem


  • 2.  RE: ARP CACHE POISONING

    Posted 12-09-2017 19:14
    At this moment i dont have de document, but can you find a best practice firewall for wingx .


  • 3.  RE: ARP CACHE POISONING

    Posted 12-11-2017 10:11
    HI Aviv,

    it rather depends on the source address - you see that destination is FF::FF / 00::00 which looks like Gratuitous ARP

    Try to search for the source and if found, confirm you do not have IP conflict.

    Regards,
    Ondrej


  • 4.  RE: ARP CACHE POISONING

    Posted 01-28-2018 06:21
    Hello All,

    This issue may appear if used vc for ap6532 + other vc for ap7532 on the same vlan?
    We need it for configuration provosioning of these two models of ap.

    Thanks,

    Aviv


  • 5.  RE: ARP CACHE POISONING

    Posted 07-26-2018 15:45
    With best practice all its ok


  • 6.  RE: ARP CACHE POISONING

    Posted 07-27-2018 10:19
    Hello,

    These Firewall (L2) Logs occur when the controller is running on the same data VLAN of an environment (which has servers, cameras, printers, and so on).

    In my case, when I segmented the controller network into a separate VLAN (where it only has L2 traffic from the APs and controller), the problems have stopped.

    I recommend doing a rework on the internal network, creating native / untagged VLANs to exchange traffic between controller and access point. The problems will disappear.


  • 7.  RE: ARP CACHE POISONING

    Posted 12-09-2017 19:14
    Hello Jesus,
    I would be happy to receive an answer for the question I asked.
    It's not about best practice.

    Regards,

    Aviv


  • 8.  RE: ARP CACHE POISONING

    Posted 12-11-2017 10:11
    Hello Ondrej,

    We do not have IP conflict but still have a lot of these messages.
    It seems that router is fluding different L2 data .

    Any ideas?

    Thanks,

    Aviv


  • 9.  RE: ARP CACHE POISONING

    Posted 12-11-2017 10:11
    Well, if you see those hits it mean that internal firewall detected those and took action.
    I would not say this is something you'll fix on the AP.

    Regards,
    Ondrej



  • 10.  RE: ARP CACHE POISONING

    Posted 12-11-2017 10:11
    Do you use a firewall cluster? See this offend, if two MAC address share the same IP. This is mostly, if it's a cluster.

    If you use a cluster you can set "ip arp trust" to the interface or disable the check under the firewall policy:
    no ip-mac conflict

    no ip-mac routing conflict



  • 11.  RE: ARP CACHE POISONING

    Posted 12-11-2017 10:11
    Many thanks guys.

    Aviv


  • 12.  RE: ARP CACHE POISONING

    Posted 07-27-2018 10:19
    Hello Richard Augusto,

    Do you mean a have to separate the controller vlan and the wlan traffic vlan?

    Thanks,

    Aviv


  • 13.  RE: ARP CACHE POISONING

    Posted 07-27-2018 10:19
    Exactly. Put the Access Points with port configuration in hybrid mode. The Untagged VLAN is where the L2 traffic of the controller will pass. SSID traffic must pass through specific tagged VLANs.

    These ARP Poisoning (and many others) errors occur here and are only in places where my network is flat.


  • 14.  RE: ARP CACHE POISONING

    Posted 07-27-2018 10:19
    Hello Richard,

    Thank you for your support.

    Aviv