TMA-FORTISWITCH-2.5.2
Dynamic ARP Inspection
Descripción
Dynamic ARP Inspection (DAI) is a security feature available on switches that validates ARP packets on the network to prevent ARP spoofing and ARP-based man-in-the- middle attacks. It verifies ARP requests and responses against trusted sources, such as DHCP snooping and static ARP entries. PASS requires arp-inspection enable on at least one VLAN; confirm all user VLANs. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.
Cómo se verifica
Método de auditoría: Patrón de configuración
- Patrón
(?m)^config switch vlan\n(?:[ \t]+[^\n]*\n)*?[ \t]+set arp-inspection enable[ \t]*$
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
config switch vlan edit <vlan-id> set arp-inspection enable next end # CIS guidance: Following command enables Dynamic ARP inspection on the current VLAN, which means that ARP packets received from untrusted interfaces are discarded if they have an Invalid IP-to-MAC address binding. From the CLI: config switch vlan edit <vlan-id> set arp-inspection enable end From the GUI: 1. Switch > VLAN > Select a VLAN > Edit 2. Under the DHCP Snooping section check the checkbox for "Dynamic ARP Inspection". By default, all ports are untrusted so you will need to specify trusted ports for uplinks to DHCP Servers or to a directly connected DHCP Server. Refer to the DHCP Snooping section for the DHCP snooping configuration.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- fortiswitchthreat-prevention
- Referencia
- CIS FortiSwitch Benchmark v1.0.0 - 2.5.2 Dynamic ARP Inspection
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target fortiswitch