arp reply restricted

Options
crispy
crispy Posts: 2 image  Freshman Member
Friend Collector
in USG FLEX H Series

Previous to the Flex100H Series routers we were able to run the "arp reply restricted" cli command. Is there a way to do this on the H Series routers?

The reason why we need this is because it is responding to arp request on the wan interface for IP's on the LAN interfaces.

Old Community post that references this is below.

https://community.zyxel.com/en/discussion/1497/usg310-policy-control-not-function-sometimes

Accepted Solution

  • zyman2008
    zyman2008 Posts: 243 image  Master Member
    50 Answers First Comment Friend Collector Eighth Anniversary
    Answer ✓

    Hi @p4_greg

    edit running
    system network-stack arp-seal enabled false
    system network-stack ipv4 arp-ignore check-interface-and-subnet
    commit

All Replies

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,616 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @crispy

    I checked the CLI guide and the device, seems like no similar command. Please allow us to check further and I will update you once I get further info.

    Zyxel Melen


  • Zyxel_Melen
    Zyxel_Melen Posts: 4,616 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited March 12

    Hi @crispy

    Please help to use this command to reach your goal in current firmware:

    system network-stack ipv4 arp-ignore check-interface-and-subnet

    Here is the configure steps:

    usgflex700h> edit running
usgflex700h running config# system network-stack arpseal enabled false
usgflex700h running config# system network-stack ipv4 arp-ignore check-interface-and-subnet
usgflex700h running config# commit
usgflex700h running config# copy running startup
Overwrite startup configuration? [y/N] y

    P.S. We will update the CLI reference guide in the future. You may follow Security Gateway New Release - Zyxel Community category to receive the news.

    Zyxel Melen


  • p4_greg
    p4_greg Posts: 39 image  Freshman Member
    Network Detective-New Adventure Badge First Comment Friend Collector Fourth Anniversary

    According to the FLEX H CLI Reference_v1.37, the arp-seal command is for arp spoofing prevention, which is not the same as the functionality provided by the 'arp reply restricted' command on ZLD-based firewalls.

    Admittedly, it is a somewhat confusing (and uncommon) scenario that causes our issue which was previously mitigated by the 'arp reply restricted' command….but I will attempt to explain:

    -When setting up a brand-new firewall which is to be installed at a customer's site at a later date, we will connect the WAN port of the new firewall to our companies' internal 'customer staging' VLAN.

    —The 'customer staging' VLAN has an interface IP of 192.168.10.1/24, and a sub-interface/secondary-ip of 10.10.1.1/24

    —The 'brand-new' firewall has ge1/WAN connected to the 'staging' network with an IP of 192.168.10.xxx/24

    —The 'brand-new' firewall also has 10.10.1.1/24 configured on its ge3/LAN interface

    —The 'brand-new' firewall responds to ARP requests for the 10.10.1.0/24 subnet on its ge1/WAN interface

    This causes communication issues with other devices in the 'customer staging' sub-interface since these devices now have the MAC of the 'brand-new' firewall in their ARP table

    'arp reply restricted' command stops this behavior, so the firewall does not respond to ARP requests on its WAN port for the subnets that are present on its LAN/internal interfaces

  • zyman2008
    zyman2008 Posts: 243 image  Master Member
    50 Answers First Comment Friend Collector Eighth Anniversary
    Answer ✓

    Hi @p4_greg

    edit running
    system network-stack arp-seal enabled false
    system network-stack ipv4 arp-ignore check-interface-and-subnet
    commit

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,616 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Thanks @zyman2008's notice.

    I have updated the previous reply.

    Zyxel Melen


  • p4_greg
    p4_greg Posts: 39 image  Freshman Member
    Network Detective-New Adventure Badge First Comment Friend Collector Fourth Anniversary
    https://community.zyxel.com/en/discussion/comment/83977#Comment_83977

    Thanks a bunch for sharing this @zyman2008! Works perfectly!!!

    I guess I should have spent more time poking around in the cli…I see there are many undocumented options to play with😁

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）