Configuring a Device to Send ARP/ND Proxy Packets for a STA After the STA Is Successfully Associated

Context

If an AP is enabled to send ARP/ND proxy packets for a STA before the STA succeeds in authentication or key negotiation, the Layer 2 switch connected to the AP will learn the MAC address of the STA. If an attack floods thousands of STA MAC addresses, the MAC address table on the switch will be seriously corrupted, bringing security risks. To avoid this issue, you can run the undo sta arp-nd-proxy before-assoc command to configure the AP to send ARP/ND proxy packets for a STA after the STA succeeds in authentication or key negotiation.

In scenarios with low security requirements, you can run the sta arp-nd-proxy before-assoc command to configure the AP to send ARP/ND proxy packets for a STA before the STA is successfully associated to improve link update efficiency.

Procedure

Run system-view
The system view is displayed.
Run wlan
The WLAN view is displayed.
Run ap-system-profile name profile-name
An AP system profile is created, and the AP system profile view is displayed.

By default, the system provides the AP system profile default.
Run undo sta arp-nd-proxy before-assoc
The device is configured to send ARP/ND proxy packets for a STA after the STA is successfully associated.

By default, an AP does not send ARP/ND proxy packets for a STA before the STA is successfully associated.
Run quit
Return to the WLAN view.
Bind an AP system profile to an AP group or AP.
- Binding an AP system profile to an AP group.
  1. Run the ap-group name group-name command to enter the AP group view.
  2. Run the ap-system-profile profile-name command to bind the AP system profile to the AP group.
    
    By default, the AP system profile default is bound to an AP group.
- Binding an AP system profile to an AP.
  1. Run the ap-id ap-id, ap-mac ap-mac, or ap-name ap-name command to enter the AP view.
  2. Run the ap-system-profile profile-name command to bind the AP system profile to the AP.
    
    By default, no AP system profile is bound to an AP.