H3C 防火墙频繁报ARP-spoofing

组网情况：所有设备共用一个C类网段，10.0.0.0/24，电脑网关配置为RT1的IP，配置后防火墙经常报arp攻击，基本每台电脑都会报，但是网关和电脑的MAC地址都是正确的。想请教一下是什么机制触发防火墙报arp欺骗。

atckType(1016)=(21)ARP-spoofing;rcvIfName(1023)=Ethernet1/1;srcIPAddr(1017)=10.0.0.214More Information;srcMacAddr(1021)=44-39-c4-90-29-02;destIPAddr(1019)=10.0.0.7.1More Information;destMacAddr(1022)=74-25-8a-71-cf-03;atckSpeed(1047)=0;atckTime_cn(1048)=20211231132440

防火墙配置如下：

# firewall packet-filter enable firewall packet-filter default permit # insulate # undo connection-limit enable connection-limit default deny connection-limit default amount upper-limit 50 lower-limit 20 # firewall mode transparent firewall system-ip 10.0.0.17 255.255.255.0 # firewall statistic system enable # radius scheme system # domain system # # interface Aux0 async mode flow # interface Ethernet0/0 promiscuous # interface Ethernet0/1 promiscuous # interface Ethernet0/2 promiscuous # interface Ethernet0/3 promiscuous # interface Ethernet1/0 promiscuous # interface Ethernet1/1 promiscuous # interface Ethernet1/2 promiscuous # interface NULL0 # interface LoopBack0 ip address 10.0.0.17 255.255.255.0 # interface LoopBack1 # firewall zone local set priority 100 # firewall zone trust add interface Ethernet1/0 set priority 85 # firewall zone untrust add interface Ethernet1/1 set priority 5 # firewall zone DMZ set priority 50 # firewall interzone local trust # firewall interzone local untrust # firewall interzone local DMZ # firewall interzone trust untrust # firewall interzone trust DMZ # firewall interzone DMZ untrust # ip route-static 0.0.0.0 0.0.0.0 10.0.0.1 preference 60 ip route-static 10.0.0.0 255.255.255.128 10.0.0.18 preference 30 # firewall defend land firewall defend smurf firewall defend fraggle firewall defend winnuke firewall defend icmp-redirect firewall defend icmp-unreachable firewall defend source-route firewall defend route-record firewall defend tracert firewall defend ping-of-death firewall defend tcp-flag firewall defend ip-fragment firewall defend large-icmp firewall defend teardrop firewall defend ip-sweep firewall defend port-scan firewall defend arp-spoofing firewall defend arp-flood firewall defend frag-flood firewall defend syn-flood enable firewall defend udp-flood enable firewall defend icmp-flood enable # user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode scheme user privilege level 3 protocol inbound ssh # return