This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

ARP Hardening

Sophos states this in there KB.

"ARP Hardening If enabled, the device will send an ARP reply only if the destination IP address is a local address configured on the incoming interface and both the sender and destination IP address are in the same subnet."

I am debating if I need this on or not. So I have two questions.

1. The statement "...same subnet", does this mean a /8 subnet or the subnet setup on the port?

2. What are the pros/cons on enabling this?

This thread was automatically locked due to age.

Parents

0 Jaydeep over 4 years ago

Hi CyberEagle

Would you please mention the KBA you're referring to?

Regarding this first question, it would always mean the subnet configured on the Port. Second, I can only reply when I go through the actual article.

Regards

Jaydeep
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Jaydeep over 4 years ago

Hi CyberEagle

Would you please mention the KBA you're referring to?

Regarding this first question, it would always mean the subnet configured on the Port. Second, I can only reply when I go through the actual article.

Regards

Jaydeep
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 CyberEagle over 4 years ago in reply to Jaydeep

https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/DoSBypassRuleManage.html?hl=arp%2Chardening
Cancel
Vote Up 0 Vote Down

Cancel
+1 Jaydeep over 4 years ago in reply to CyberEagle

Thanks for the details. ARP Hardening is used to prevent ARP Flood and ARP Poison attacks. It will prevent ARP updates from other networks and will only allow it from the local subnet. You should keep it off unless you're facing that issue from local network.

Regards

Jaydeep
Cancel
Vote Up 0 Vote Down

Cancel