ARP Hardening

Question

Sophos states this in there KB. 
 "ARP Hardening If enabled, the device will send an ARP reply only if the destination IP address is a local address configured on the incoming interface and both the sender and destination IP address are in the same subnet." 
 I am debating if I need this on or not. So I have two questions. 
 1. The statement "...same subnet", does this mean a /8 subnet or the subnet setup on the port? 
 2. What are the pros/cons on enabling this?

Jaydeep · Accepted Answer

Thanks for the details. ARP Hardening is used to prevent ARP Flood and ARP Poison attacks. It will prevent ARP updates from other networks and will only allow it from the local subnet. You should keep it off unless you're facing that issue from local network.