TMA-FORTISWITCH-2.5.2
Dynamic ARP Inspection
Açıklama
Dynamic ARP Inspection (DAI) is a security feature available on switches that validates ARP packets on the network to prevent ARP spoofing and ARP-based man-in-the- middle attacks. It verifies ARP requests and responses against trusted sources, such as DHCP snooping and static ARP entries. PASS requires arp-inspection enable on at least one VLAN; confirm all user VLANs. Audited against FortiSwitchOS 'show full-configuration' output (standalone FortiSwitch, saved in full); patterns are scoped to the named 'config ... end' block, whose member lines are indented.
Nasıl denetlenir
Denetim yöntemi: Yapılandırma deseni
- Desen
(?m)^config switch vlan\n(?:[ \t]+[^\n]*\n)*?[ \t]+set arp-inspection enable[ \t]*$
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
config switch vlan edit <vlan-id> set arp-inspection enable next end # CIS guidance: Following command enables Dynamic ARP inspection on the current VLAN, which means that ARP packets received from untrusted interfaces are discarded if they have an Invalid IP-to-MAC address binding. From the CLI: config switch vlan edit <vlan-id> set arp-inspection enable end From the GUI: 1. Switch > VLAN > Select a VLAN > Edit 2. Under the DHCP Snooping section check the checkbox for "Dynamic ARP Inspection". By default, all ports are untrusted so you will need to specify trusted ports for uplinks to DHCP Servers or to a directly connected DHCP Server. Refer to the DHCP Snooping section for the DHCP snooping configuration.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- fortiswitchthreat-prevention
- Referans
- CIS FortiSwitch Benchmark v1.0.0 - 2.5.2 Dynamic ARP Inspection
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target fortiswitch