3

I am using 802.1x authentication with dynamic Vlan assignment(CPPM). As you may know, when a user logges in to their computer, SW attaches the user port to related Vlan. Thinking the scenario in which machine authenticated (no user logged in) port is in Vlan 10, for example. And, when Tom logges in, the port is attached to Vlan 20. My problem is arp-protection; I want to apply arp-protection on those swithces but it does not allow new Vlan attachment because there will be two entry on dhcp snoop binding that triggers arp-protection as an arp-spoof clue.

To overcome the problem what should I do? Any technical practice or advice is welcome.

3
  • 1
    I assume vl 10 is a sort of "untrusted" vlan. Do you need arp inspection on vl 10? Is just restricting access on that vlan enough? – Ron Trunk Feb 13 '20 at 15:25
  • Ron, Vlan 1 is not completely untrusted. In fact, it's the common user Vlan which has both restricted access on Network and defaut Users. – Jacky Spar Feb 14 '20 at 6:26
  • 1
    A better solution (albeit requiring some engineering) is to create a default untrusted vlan with restricted access (just enough for machine authentication). That may eliminate the need for arp inspection on the default vlan. – Ron Trunk Feb 14 '20 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.