3.5 Ensure proxy-arp is disabled

Information

Do not use Proxy ARP.

Rationale:

Address Resolution Protocol (ARP) provides resolution between IP and MAC Addresses (or other Network and Link Layer addresses on none IP networks) within a Layer 2 network.

Proxy ARP is a service where a device connected to one network (in this case the JUNOS router) answers ARP Requests which are addressed to a host on another network, replying with its own MAC Address and forwarding the traffic on to the intended host.

Sometimes used for extending broadcast domains across WAN links, in most cases Proxy ARP on enterprise networks is used to enable communication for hosts with mis-configured subnet masks, a situation which should no longer be a common problem.

Proxy ARP effectively breaks the LAN Security Perimeter, extending a network across multiple Layer 2 segments. Using Proxy ARP can also allow other security controls such as PVLAN to be bypassed.

Solution

To disable Proxy ARP enter the following command from the [edit interfaces <interface name> unit <unit number>] hierarchy:

[edit interfaces <interface name> unit <unit number>]
user@host#delete proxy-arp

Default Value:

Proxy ARP is disabled by default on most JUNOS routers.

See Also

https://workbench.cisecurity.org/files/3069

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv7|12

Plugin: Juniper

Control ID: 1455d322207a83873eb5f8f1cc415b139fe2a4407f7dbb022074e7d96cfbb4e5