Configuring ARP Enforcement

Network Sensor by default is configured to passively collect information and forward it to the Policy Server. This information assists in identifying the endpoints information, allowing you to build groups and policies. Network Sensor Operating Mode needs to be changed from Monitoring to Enforcement which allows the Policy Server to enforce policies and control endpoints access onto the network using ARP Enforcement.

For more information. See Policy Enforcement Methods

Note

ARP Enforcement may trigger security alerts from IDS or EDR products, see: ARP Enforcement does not block network access

Enabling ARP Enforcement

You can enforce policies by activating the Network Sensor. The Network Sensor has two types of Sensor Operating Modes. By default, the Network Sensor is set to Monitoring mode.

To activate the Network Sensor enforcement:

  1. Go to System in the top panel
  2. Select the desired sensor’s IP Address for activating enforcement
  3. Click the Sensor tab
  4. Click the Interface of the sensor you wish to activate.
  5. For Sensor Mode, select Host
  6. For Sensor Operating Mode, change to Enforcement
  7. Configure optional Enforcement Exceptions Unmanaged IP ranges.
  8. Configure Managed IP Control Range
  9. Click Update