Fortinet FortiSwitch
TMA-FORTISWITCH-2.5.2
Dynamic ARP Inspection
Descrição
Dynamic ARP Inspection (DAI) is a security feature available on switches that validates ARP packets on the network to prevent ARP spoofing and ARP-based man-in-the- middle attacks. It verifies ARP requests and responses against trusted sources, such as DHCP snooping and static ARP entries. PASS requires arp-inspection enable on at least one VLAN; confirm all user VLANs. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.
Como é verificado
Método de auditoria: Padrão de configuração
- Padrão
(?m)^config switch vlan\n(?:[ \t]+[^\n]*\n)*?[ \t]+set arp-inspection enable[ \t]*$
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
config switch vlan edit <vlan-id> set arp-inspection enable next end # CIS guidance: Following command enables Dynamic ARP inspection on the current VLAN, which means that ARP packets received from untrusted interfaces are discarded if they have an Invalid IP-to-MAC address binding. From the CLI: config switch vlan edit <vlan-id> set arp-inspection enable end From the GUI: 1. Switch > VLAN > Select a VLAN > Edit 2. Under the DHCP Snooping section check the checkbox for "Dynamic ARP Inspection". By default, all ports are untrusted so you will need to specify trusted ports for uplinks to DHCP Servers or to a directly connected DHCP Server. Refer to the DHCP Snooping section for the DHCP snooping configuration.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- fortiswitchthreat-prevention
- Referência
- CIS FortiSwitch Benchmark v1.0.0 - 2.5.2 Dynamic ARP Inspection
Verificar este host
Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.
tmaegis scan --target fortiswitch