Any feature to help block/mitigate arp poisoning attacks?

[hostasaurus]

Hi all, in a physical world, there exists technologies on the switching side to help deal with arp poisoning, such as Cisco's dhcp snooping and dynamic arp inspection.  We can of course protect all servers, physical and virtual, from the effects of attempted arp poisoning of the router mac by hard coding the router's mac address on each system.  What I'm really after though is a way to prevent a VM from sending malicious responses to broadcasts from the router looking for the MAC of a given IP; i.e. vm1 has mac 0011.2233.4455 and IP 192.0.2.1, vm2 has mac 2233.4455.6677 and IP 192.0.2.2.  vmware tools are running and vmware knows this.  I want to prevent vm2 from sending a response to a broadcast from the router for who has 192.0.2.1 with its mac address.  I could of course hard code the arp table on the router to protect router to vm communications, but we're talking way too many addresses to do that to begin with, and it still wouldn't protect other intra-vlan communications between systems on that vlan.

I'm running 5.5 enterprise plus.

[DavoudTeimouri]

Did you check vShield products?

I think, vShield Zone can help you at this regard.

[zXi_Gamer]

There are options in vSwitch to disable such mac address changes. Check the below link

VMware vSphere 4 ESXi Installable and vCenter Server Documentation Center

Though it is for vsphere 4, the same applies to vsphere 55 also

[hostasaurus]

Thanks; I took a quick glance at vShield but I don't think it would work.  It comes close in that it lets you segment traffic, but I've effectively already done that by putting different machines on different vlan's, so when one causes a problem, it is at least limited to that vlan.  It also appears to let you firewall down to the vm level, but I'm not sure if the rules could be granular enough to accomplish what I need, and even if it could, it would likely be a very heavy administrative burden; i.e. I would need it to support adding a rule to every guest that states "if a gratuitous arp is generated by this VM that announces it has IP addresses other than X, Y and Z, drop it."  With that much work, I'd probably be better off just hard coding the arp table on the routers since I can automate that.

I'm going to investigate vshield further with our sales rep though just to make sure.

[hostasaurus]

The option to disable mac changes won't help because this is not what the guests are doing.  Basically what I'm wanting to prevent is a compromised server (guest) from sending out fraudulent arp responses or gratuitous arp packets for ip addresses that are not on that guest.  It's not changing it's mac, it's just trying to announce it's mac for ip's it doesn't have.  vmware tools has knowledge of every ip address configured on the guest OS, so I was hoping there'd be some automated way to let vsphere block what vmware tools would know to be bogus arp's.

[MKguy]

Correct, the normal port group security features such as MAC address changes and forged transmits are useless in this case. Unfortunately vSphere offers nothing out of the box to prevent ARP-spoofing.

The Cisco 1000V dvSwitch should be able to protect against it through the standard Cisco security features though.

As for vShield App (a vNIC level firewall), it offers an IP-spoofing protection feature with which the offending guest will at least be unable to forward IP packets with a forged source IP:

http://vshieldsuite.wordpress.com/2012/07/12/spoof-guard/