Header Only - DO NOT REMOVE - Extreme Networks

ARP CACHE POISONING


Userlevel 2
Hello Community,

I use ip mac conflict log only. AP75XX/AP65XX. WING 5.8.6+/5.9+.
Recently, in several deployments I saw a lot of this type of logs messages:

...%DATAPLANE-4-ARPPOISON: ARP CACHE POISONING: Conflicting snoop entry found :Ethernet Src Mac: ....., Ethernet Dst Mac: FF-FF-FF-FF-FF-FF, ARP Src Mac: ...., ARP Dst Mac: 00-00-00-00-00-00, ARP Src IP: ...., ARP Target IP: ...., Snoop Table MAC = ...., Snoop Table IP = ....

It seems the router is flooding some different info about mac adress table info with AP.
Can it cause any network issues ?

Thanks,

Aviv Kedem

13 replies

At this moment i dont have de document, but can you find a best practice firewall for wingx .
Userlevel 2
JESUS REYES DIAZ wrote:

At this moment i dont have de document, but can you find a best practice firewall for wingx .

Hello Jesus,
I would be happy to receive an answer for the question I asked.
It's not about best practice.

Regards,

Aviv
Userlevel 6
HI Aviv,

it rather depends on the source address - you see that destination is FF::FF / 00::00 which looks like Gratuitous ARP

Try to search for the source and if found, confirm you do not have IP conflict.

Regards,
Ondrej
Userlevel 2
Ondrej Lepa wrote:

HI Aviv,

it rather depends on the source address - you see that destination is FF::FF / 00::00 which looks like Gratuitous ARP

Try to search for the source and if found, confirm you do not have IP conflict.

Regards,
Ondrej

Hello Ondrej,

We do not have IP conflict but still have a lot of these messages.
It seems that router is fluding different L2 data .

Any ideas?

Thanks,

Aviv
Userlevel 6
Ondrej Lepa wrote:

HI Aviv,

it rather depends on the source address - you see that destination is FF::FF / 00::00 which looks like Gratuitous ARP

Try to search for the source and if found, confirm you do not have IP conflict.

Regards,
Ondrej

Well, if you see those hits it mean that internal firewall detected those and took action.
I would not say this is something you'll fix on the AP.

Regards,
Ondrej
Userlevel 4
Ondrej Lepa wrote:

HI Aviv,

it rather depends on the source address - you see that destination is FF::FF / 00::00 which looks like Gratuitous ARP

Try to search for the source and if found, confirm you do not have IP conflict.

Regards,
Ondrej

Do you use a firewall cluster? See this offend, if two MAC address share the same IP. This is mostly, if it's a cluster.

If you use a cluster you can set "ip arp trust" to the interface or disable the check under the firewall policy:
no ip-mac conflict

no ip-mac routing conflict
Userlevel 2
Ondrej Lepa wrote:

HI Aviv,

it rather depends on the source address - you see that destination is FF::FF / 00::00 which looks like Gratuitous ARP

Try to search for the source and if found, confirm you do not have IP conflict.

Regards,
Ondrej

Many thanks guys.

Aviv
Userlevel 2
Hello All,

This issue may appear if used vc for ap6532 + other vc for ap7532 on the same vlan?
We need it for configuration provosioning of these two models of ap.

Thanks,

Aviv
With best practice all its ok
Userlevel 2
Hello,

These Firewall (L2) Logs occur when the controller is running on the same data VLAN of an environment (which has servers, cameras, printers, and so on).

In my case, when I segmented the controller network into a separate VLAN (where it only has L2 traffic from the APs and controller), the problems have stopped.

I recommend doing a rework on the internal network, creating native / untagged VLANs to exchange traffic between controller and access point. The problems will disappear.
Userlevel 2
Richard Augusto wrote:

Hello,

These Firewall (L2) Logs occur when the controller is running on the same data VLAN of an environment (which has servers, cameras, printers, and so on).

In my case, when I segmented the controller network into a separate VLAN (where it only has L2 traffic from the APs and controller), the problems have stopped.

I recommend doing a rework on the internal network, creating native / untagged VLANs to exchange traffic between controller and access point. The problems will disappear.

Hello Richard Augusto,

Do you mean a have to separate the controller vlan and the wlan traffic vlan?

Thanks,

Aviv
Userlevel 2
Richard Augusto wrote:

Hello,

These Firewall (L2) Logs occur when the controller is running on the same data VLAN of an environment (which has servers, cameras, printers, and so on).

In my case, when I segmented the controller network into a separate VLAN (where it only has L2 traffic from the APs and controller), the problems have stopped.

I recommend doing a rework on the internal network, creating native / untagged VLANs to exchange traffic between controller and access point. The problems will disappear.

Exactly. Put the Access Points with port configuration in hybrid mode. The Untagged VLAN is where the L2 traffic of the controller will pass. SSID traffic must pass through specific tagged VLANs.

These ARP Poisoning (and many others) errors occur here and are only in places where my network is flat.
Userlevel 2
Richard Augusto wrote:

Hello,

These Firewall (L2) Logs occur when the controller is running on the same data VLAN of an environment (which has servers, cameras, printers, and so on).

In my case, when I segmented the controller network into a separate VLAN (where it only has L2 traffic from the APs and controller), the problems have stopped.

I recommend doing a rework on the internal network, creating native / untagged VLANs to exchange traffic between controller and access point. The problems will disappear.

Hello Richard,

Thank you for your support.

Aviv

Reply