topic ARP Validation with dynamically assigned VLANs in Security

ARP Validation with dynamically assigned VLANs

Michael_Eisensc — Tue, 19 Nov 2019 21:02:35 GMT

Hello Community,

I was wondering about the appropriate way to configure ARP Validation in an Extreme Access Control Environment with dynamically assigned VLANs.

From what I have found so far, you have to configure ARP Validation per vlan and port. This is not possible if the vlan, which should later be dynamically assigned to the port, is not statically configured on the port:

* EXOS-VM.2 # enable ip-security dhcp-snooping vlan red ports 1 violation-action drop-packet block-mac duration 300 snmp-trap

ERROR: Port 1 does not belong to vlan red.

* EXOS-VM.4 # enable ip-security arp validation vlan red ports 1 violation-action drop-packet snmp-trap

ERROR: Port 1 does not belong to vlan red.

I have seen that in XOS 30.2 a Dynamic VLAN and VLAN ID option has been added. I assume this option is only for VLANs created in a Fabric Connect environment and not for dynamically assigned VLANs based on an Authentication. Is my assumption correct?

I know that IP-Security Features apply after the Authentication takes place. What I would not want to do is an implementation with a port macro - if this is even possible.

Could someone please help me?

Kind regards

Michael

Re: ARP Validation with dynamically assigned VLANs

jeronimo — Wed, 05 May 2021 22:21:50 GMT

I'd be interested to know this too.

Re: ARP Validation with dynamically assigned VLANs

Pullin1458 — Thu, 13 May 2021 13:08:03 GMT

You enable dynamic ARP inspection on a per-VLAN basis by using the ip arp inspection vlan vlan-range global configuration command. In non-DHCP environments, dynamic ARP inspection can validate ARP packets against user-configured ARP access control lists (ACLs) for hosts with statically configured IP addresses.

Re: ARP Validation with dynamically assigned VLANs

Pullin1458 — Fri, 14 May 2021 14:19:47 GMT