ZyXEL XMG2230-52HP Anti-ARP Scan

Options
nielsscheldeman
nielsscheldeman Posts: 131
First Comment Friend Collector Fourth Anniversary
image  Ally Member
edited September 4 in Switch

So I've set up Anti-ARP scan on my switch and it seemed to work fine. As soon as I used Netscan, my device got blocked. So far so good, but so did my domain controller with DHCP running on(RTFM 😅). No problem, I added the IP-Address of my DC/DHCP to the Anti-ARP Scan Trust Host and thought everything would be fine.

But today I did a Netscan again and my device didn't block. Weird. The device I use is not domain joined and on a different switch port. As soon as I removed the trust host, it worked again? Is this a bug? Yes I could exclude the port where my DC runs on, but on that same port I also have my RD Gateway VM running on, if that one is compromised, I'd love to have Anti-ARP enabled on it. So that's not an option.

I run on firmware version V2.00(ACNO.1). Also in this firmware there is a bug considering the error count on the ports.(already mentioned that couple of months ago and ZyXEL classified this as bug, but no new firmware has been released since then)

Edit: think I found it. I filled in subnet mask 255.255.255.0 instead of 255.255.255.255, seems to work better now :) my bad

All Replies

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,789
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    image  Zyxel Employee
    Options

    Hi @nielsscheldeman ,

    So glad to hear the issue has been resolved.

    Regarding the next official firmware release for the XMG2230-52HP, it's currently scheduled for Q4 2026. Please follow the Switch News & Release section for any updates.

    Zyxel_Judy

  • nielsscheldeman
    nielsscheldeman Posts: 131
    First Comment Friend Collector Fourth Anniversary
    image  Ally Member
    Options

    Ok, now been running at our own offices and at a client (with 50 users) the ANTI-ARP scan and it works great, also passed a security audit with great success.

    But I miss some optimization. My client says that sometimes if laptops switch from docking station to wifi, they get blocked. I have now raised the default PPS from 10 to 20. Or what should be a normal setting for both hosts and port?

    I also don't see many logging about it. Is there a way where I can see why a device got blocked and after how many PPS? I also tried to read out Anti-ARP through OIDC, but only thing I'm getting is a counter on a blocked port, but then I should monitor all ports separately. Isn't there a way to get OIDC value if there is a blocked host or port?

Categories

Switch Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）