Detections
Analytics

NET0780 - Proxy ARP must be disabled on external interfaces.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The administrator must ensure IP Proxy ARP is disabled on all external interfaces.

 When proxy ARP is enabled on a Cisco router, it allows that router to extend the network (at Layer 2) across multiple interfaces (LAN segments). Because proxy ARP allows hosts from different LAN segments to look like they are on the same segment, proxy ARP is only safe when used between trusted LAN segments. Attackers can leverage the trusting nature of proxy ARP by spoofing a trusted host and then intercepting packets. You should always disable proxy ARP on router interfaces that do not require it, unless the router is being used as a LAN bridge.

 NOTE: This check reviews all interfaces to determine if ip proxy-arp is disabled. Review the results to ensure your external interfaces have proxy-arp disabled.

Solution

The administrator must change the router configuration files to include the no ip proxy-arp command for each external interface of every router.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_Perimeter_Router_L3_Switch_V8R32_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(16), CAT|II, Rule-ID|SV-3082r2_rule, STIG-ID|NET0780, Vuln-ID|V-3082

Plugin: Cisco

Control ID: 7015c2b02a19afbd071e13a0446f7004504aff7f8e7371befaf0fa88c331c9c8