Details
Do not use Proxy ARP.
Rationale:
Address Resolution Protocol (ARP) provides resolution between IP and MAC Addresses (or other Network and Link Layer addresses on none IP networks) within a Layer 2 network.
Proxy ARP is a service where a device connected to one network (in this case the JUNOS router) answers ARP Requests which are addressed to a host on another network, replying with its own MAC Address and forwarding the traffic on to the intended host.
Sometimes used for extending broadcast domains across WAN links, in most cases Proxy ARP on enterprise networks is used to enable communication for hosts with mis-configured subnet masks, a situation which should no longer be a common problem.
Proxy ARP effectively breaks the LAN Security Perimeter, extending a network across multiple Layer 2 segments. Using Proxy ARP can also allow other security controls such as PVLAN to be bypassed.
Solution
To disable Proxy ARP enter the following command from the [edit interfaces
[edit interfaces
[email protected]#delete proxy-arp
Default Value:
Proxy ARP is disabled by default on most JUNOS routers.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Juniper.