D-Link DGS-3627G Product Manual - Page 366

xStack® DGS-3600 Series Layer 3 Managed Gigabit Ethernet Switch Figure 7- 7. ARP Cache Poisoning When the user configures strict mode and enables IMPB on a port, ARP inspection is enabled. For an ARP inspection active port: All ARP packets should be captured to the CPU (including broadcast ARP and unicast ARP packets) and the CPU will make the decision to either forward or drop. The switch will validate the ARP packets by retrieving the sender's MAC/ IP address from the ARP packet payload and sender hardware address. If the IP/ MAC address are in the IMPB forwarding list, the ARP packets will be forwarded. Otherwise, the ARP packet will be discarded. Strict State Behavior Change As the figure below shows, in a mixed network (both IPv4 and IPv6 used), if illegal IPv4-A packets are detected and there are write-blocked FDB entries, then IPv6-Global also cannot access the network. To avoid this case, do not write-block FDB. Not write-blocking FDB can also avoid netcut attacks and recover attacks. Figure 7- 8. IPv4 and IPv6 Sharing When enabling Strict state, the Switch will stop writing dropped FDB entries on these ports. If the Switch detects legal packets, the Switch will need to create the FDB forwarding entries. ACL mode always runs under Strict state. When a user enables ACL mode on some ports, these ports will change from Loose state to Strict state and the configuration will also change to Strict state. For compound authentication And mode (IMPB+1X, IMPB+WAC, IMPB+JWAC), the ports always run in Strict state. IMPB Global Settings This window is used to enable or disable IP-MAC-port binding global settings. To view this window click, Security > IP-MAC-Port Binding > IMPB Global Settings, as shown below: 350