MAC+IP Clones

Genian ZTNA can detect MAC / IP theft in a variety of ways. The Network Sensor periodically sends an ARP request to check the operation status of Nodes. If two MAC's answer to a request for one IP, Genian ZTNA designates the more recently detected Node as a critical Node.

In addition, if the user changes the MAC on the endpoint where the Agent is installed and the MAC is already being used by another device, that device is then designated as a critical Node. Genian ZTNA provides industry-leading platform detection to detect when a Node is changing to another platform, allowing administrators to see when changes are made, and to block devices when unauthorized platform changes are detected.

Configure Settings for MAC+IP Clones in Anomaly Definition

  1. Go to Policy in the top panel.
  2. Go to Policy > Node Policy > Anomaly Definition in the left Policy panel.
  3. Click MAC+IP Clones.
  4. Find Anomaly Event section to configure more options.
    • For MAC Spoofing Detection, optional setting to specify whether an interface's MAC address is manually changed is also detected.
  5. Click Update

Create Node Group For MAC+IP Cloned

  1. Go to Policy in the top panel.
  2. Go to Policy > Group > Node in the left Policy panel.
  3. Click on Tasks > Create
  4. For ID: MAC+IP Cloned.
  5. For Status: Enabled.
  6. For Boolean Operator select OR.
  7. Find and click on Add in Condition section.
  8. For each Anomaly you want to add use the followings:
    • Options: Anomaly
    • Operator: Detected is one of
    • Value: MAC+IP Clones
  9. Click Add.
  10. Keep adding Conditions as needed.
  11. Click Save.