Details

Disables the Proxy-ARP function on untrusted interfaces

Rationale:

The Firepower replies to ARP requests performed to IP addresses belonging to its interfaces’ subnets and also to global IP addresses in some NAT configurations. Where the appliance is not asked to be a proxy for ARP requests, the Proxy-ARP function should be disabled especially on untrusted interfaces since attackers can act as legitimate devices by spoofing their IP addresses, perform ARP requests thus receiving packets intended to them.

Solution

Use the Predefined FlexConfig object found in Firepower Management Center:

FlexConfig Object Name – Sysopt_noproxyarp
Configures noproxy-arp CLIs.

Supportive Information

The following resource is also helpful.

• https://www.cisco.com/c/en/us/td/docs/security/firepower/640/hardening/ftd/FTD_Hardening_Guide_v64.html

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco_Firepower.

References

• 800-53|SC-7(16)

Source

• Tenable.com/audits