This knowledge base article will explain the available options for detecting and preventing Proxy ARP attacks in a VXLAN network.

Devices may encounter significant traffic congestion on any of their interfaces as a result of a Proxy ARP attack.

To detect and prevent Proxy ARP attacks on a QFX10008 switch with VXLAN, please review the available options.

Enable Proxy ARP and ARP Suppression:

EVPN Proxy ARP feature reduces the flooding of ARP in the EVPN network,

These features are enabled by default on QFX Series switches that can act as leaf devices in an edge-routed bridging overlay.

For QFX10000 switches (including QFX10008) in an EVPN-VXLAN environment:

• Starting with Junos OS Release 17.3R1, proxy ARP and ARP suppression are supported on IRB interfaces.
• Starting with Junos OS Release 19.1R1, they are supported on non-IRB interfaces as well.

Monitor ARP Traffic:

Use the following command to monitor ARP traffic on specific interfaces: 

monitor traffic interface <interface-name> no-resolve layer2-headers matching arp count <number>

This will help you identify any unusual ARP activity.

Implement ARP Policing:

Apply an ARP policer to restrict the input ARP volume for specific interfaces: 

set firewall policer ARP_Policer if-exceeding bandwidth-limit 8k

set firewall policer ARP_Policer if-exceeding burst-size-limit 1500

set firewall policer ARP_Policer then discard set interfaces <interface-name> family inet policer arp ARP_Policer

Adjust the bandwidth-limit and burst-size-limit values as needed for your network.

Enable DDoS Protection:

Configure DDoS protection for ARP traffic: 

set system ddos-protection protocols arp aggregate flow-detection-mode on

set system ddos-protection protocols arp aggregate flow-level-bandwidth logical-interface 500

set system ddos-protection protocols arp aggregate flow-level-bandwidth physical-interface 500

set system ddos-protection protocols arp aggregate flow-level-detection subscriber on

set system ddos-protection protocols arp aggregate flow-level-detection physical-interface on

set system ddos-protection protocols arp aggregate flow-level-control logical-interface police

set system ddos-protection protocols arp aggregate flow-level-control physical-interface police

Monitor potential attacks using: 

show ddos-protection protocols arp culprit-flows

Regular Monitoring:

Periodically check ARP statistics and interface counters to identify any abnormal behavior.

By implementing these measures, you can effectively detect and prevent Proxy ARP attacks on your QFX10008 switch in a VXLAN environment. Remember to adjust the configuration values based on your specific network requirements and traffic patterns.