Hello,
I am in need of some expert advise. I have been tasked with remediating potential security risks for a client. One of those is hardening the Cisco devices which required turning off ip proxy-arp. My problem is this: There is no documentation of where this is in use in the network but I have been told it is being used. What I am trying to figure out is this:
Is there a way to do some kind of diagnostics to definatvley determine if proxy arp is being used from the cli?
are there some counters that would show this?
I need to turn it off or justify it's use but my first step is to isolate where it is being used, then i can figure out why. I do not have the option to turn it off and reinstate it if something breaks. One option is sniffers but this is unfeasible in the timeframe and the devices are dispersed everywhere so I have ruled that out as a viable option.
Basically I am trying to work through this logic:
- identify where it is on (done)
- obtain positive confirmation of it's use (stuck here)
- if not in use turn it off
- if it is used find out why, and determine if we leave it or perform steps to fix the underlying issue so we can turn off
- if it has to be left in place what steps can be taken to reduce the security risk
On step 5 I would also like some suggestions. Ie are there throttles or thresholds I can set for proxy arp that will minimize the potential for a DOS attack.
