D-Link DFL-260E User Manual for DFL-260E - Page 128
Creating ARP Objects
View all D-Link DFL-260E manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 128 highlights
3.5.3. Creating ARP Objects Chapter 3. Fundamentals connected to the firewall, it may be necessary to adjust this value upwards. This can be done by modifying the ARP advanced setting ARP Cache Size. Hash tables are used to rapidly look up entries in the ARP Cache. For maximum efficiency, a hash table should be twice as large as the entries it is indexing, so if the largest directly connected LAN contains 500 IP addresses, the size of the ARP entry hash table should be at least 1000. The administrator can modify the ARP advanced setting ARP Hash Size to reflect specific network requirements. The default value of this setting is 512. The setting ARP Hash Size VLAN setting is similar to the ARP Hash Size setting, but affects the hash size for VLAN interfaces only. The default value is 64. 3.5.3. Creating ARP Objects To change the way NetDefendOS handles ARP on an interface, the administrator can create NetDefendOS ARP objects, each of which has the following parameters: Mode The type of ARP object. This can be one of: • Static - Create a fixed mapping in the local ARP cache. • Publish - Publish an IP address on a particular MAC address (or this interface). • XPublish - Publish an IP address on a particular MAC address and "lie" about the sending MAC address of the Ethernet frame containing the ARP response. Interface The local physical interface for the ARP object. IP Address The IP address for the MAC/IP mapping. MAC Address The MAC address for the MAC/IP mapping. The three ARP modes of Static, Publish and XPublish are discussed next. Static Mode ARP Objects A Static ARP object inserts a particular MAC/IP address mapping into the NetDefendOS ARP cache. The most frequent use of static ARP objects is in situations where some external network device is not responding to ARP requests correctly and is reporting an incorrect MAC address. Some network devices, such as wireless modems, can have such problems. It may also be used to lock an IP address to a specific MAC address for increasing security or to avoid denial-of-service if there are rogue users in a network. However, such protection only applies to packets being sent to that IP address. It does not apply to packets being sent from that IP address. Example 3.19. Defining a Static ARP Entry This example will create a static mapping between IP address 192.168.10.15 and Ethernet address 4b:86:f6:c5:a2:14 on the lan interface: Command-Line Interface gw-world:/> add ARP Interface=lan IP=192.168.10.15 Mode=Static MACAddress=4b-86-f6-c5-a2-14 128