Restrict ARP answers and ignore gratuitous ARP

Description

These kernel settings limit how IPv4 hosts on the same link can influence the system through ARP:

• arp_filter = 1: answer an ARP request only on the interface the reply would be routed through;
• arp_ignore = 2: answer only when the requested address is configured on the receiving interface and the sender is in the same subnet;
• drop_gratuitous_arp = 1: ignore unsolicited ARP announcements;
• shared_media = 0 (all and default): do not send ICMP redirects between subnets sharing the same link.

ANSSI lists these settings for every host; they are hardened-only here because of their side effects on high availability setups.

Rationale

ARP has no authentication. Answering on every interface leaks the host's addresses across networks, and accepting gratuitous ARP lets anyone on the link redirect the host's traffic to their own machine (ARP poisoning).

Impact

Ignoring gratuitous ARP delays the takeover of a virtual IP address by its standby (VRRP, keepalived, Pacemaker) until the neighbour entry expires, including for the default gateway. arp_ignore = 2 breaks hosts that answer for addresses of other subnets on one interface. This is why the control is limited to the hardened profiles.

Setting

Audit

Run sysctl net.ipv4.conf.all.arp_filter net.ipv4.conf.all.arp_ignore net.ipv4.conf.all.drop_gratuitous_arp net.ipv4.conf.all.shared_media net.ipv4.conf.default.shared_media. The values must be 1, 2, 1, 0 and 0. Check that no sysctl file sets other values.

Automated: every check must pass. Scanners report each check by its id.

arp-filter

net.ipv4.conf.all.arp_filter.

key: net.ipv4.conf.all.arp_filter
value: 1

arp-ignore

net.ipv4.conf.all.arp_ignore.

key: net.ipv4.conf.all.arp_ignore
value: 2

drop-gratuitous-arp

net.ipv4.conf.all.drop_gratuitous_arp.

key: net.ipv4.conf.all.drop_gratuitous_arp
value: 1

all-shared-media

net.ipv4.conf.all.shared_media.

key: net.ipv4.conf.all.shared_media
value: 0

default-shared-media

net.ipv4.conf.default.shared_media.

key: net.ipv4.conf.default.shared_media
value: 0

Remediation

Add to /etc/sysctl.d/60-cirsec.conf:

net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.all.arp_ignore = 2
net.ipv4.conf.all.drop_gratuitous_arp = 1
net.ipv4.conf.all.shared_media = 0
net.ipv4.conf.default.shared_media = 0

remove other assignments, then run sysctl --system.

Rollback

Remove the lines from /etc/sysctl.d/60-cirsec.conf and set the previous values with sysctl -w.

arp-filter

Generated from check arp-filter: the engine writes the fix for every output, it sets the expected value and the check runs again after.

arp-ignore

Generated from check arp-ignore: the engine writes the fix for every output, it sets the expected value and the check runs again after.

drop-gratuitous-arp

Generated from check drop-gratuitous-arp: the engine writes the fix for every output, it sets the expected value and the check runs again after.

all-shared-media

Generated from check all-shared-media: the engine writes the fix for every output, it sets the expected value and the check runs again after.

default-shared-media

Generated from check default-shared-media: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Linux kernel documentation - IP Sysctl The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R12) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle