WLC 9800 secuirty hardening

[bluesea2010]

Hi ,

If the Cisco 9800 WLC is connected to the core network via a Layer 3 link, how is this setup feasible? Cisco recommends avoiding the use of SVIs on the WLC side. Instead, it is best practice to configure the SVI on the core switch and use the ip helper-address command on that SVI.
In such a design, how can ARP spoofing attacks targeting wireless client devices be mitigated?"

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#DHCPbridgingandDHCPrelay

Thanks

[Saikat Nandy]

You can enable ARP Proxy inside the Policy Profile >> Advanced tab.

[Rich R]

And in fact ARP proxy is generally recommended best practice.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#AddressResolutionProtocolARPproxy