Information theft can result from router impersonation (man-in-the-middle attacks), address theft, address spoofing, and remote address resolution cache exhaustion (denial-of-service attacks). These security breaches can come from malicious or misconfigured users and can severely disrupt Layer 2 domains and networks in general.

Nexus First-Hop Security (FHS) features enable better IPv4 and IPv6 link security and management over the Layer 2 links. In a service provider environment, these features closely control address assignment and derived operations, such as Duplicate Address Detection (DAD) and Address Resolution (AR).

The following supported FHS features secure the protocols and help build a secure endpoint database on the fabric leaf switches that are used to mitigate security threats such as man-in-the-middle (MITM) attacks and IP thefts:

ARP inspection: Allows a network administrator to intercept, log, and discard ARP packets with invalid MAC address-to-IP address bindings.

ND inspection: Learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables.

DHCP inspection: Validates DHCP messages received from untrusted sources and filters out invalid messages.

RA Guard: Allows the network administrator to block or reject unwanted or rogue router advertisement (RA) guard messages.

IPv4 and IPv6 Source Guard: Blocks any data traffic from an unknown source.

Trust Control: A trusted source is a device that is under your administrative control. These devices include the switches, routers, and servers in the fabric. Any device 811beyond the firewall or outside the network is an untrusted source. Generally, host ports are treated as untrusted sources.

FHS features provide the following security measures:

Role enforcement: Prevents untrusted hosts from sending messages that are out of the scope of their role.

Binding enforcement: Prevents address theft.

DoS attack mitigations: Prevents malicious endpoints from growing the endpoint database to the point where the database could stop providing operation services.

Proxy: Acts as proxy to increase the efficiency of address resolution.