xStack
®
DGS-3400 Series Layer 2 Gigabit Managed Switch CLI Manual
143
config address_binding ip_mac ports
port with its IMPB entries. If the IP-MAC pair in the packet matches the IMPB entry, the
MAC address will be unblocked and subsequent packets sent from this client will be
forwarded. On the other hand, if a port is set to Loose state, all packets entering the port
are permitted (forwarded) by default. The Switch will continuously compare all ARP
packets it receives on that port with its IMPB entries. If the IP-MAC pair in the ARP packet
does not match the IMPB white list, the MAC address will be blocked and subsequent
packets sent from this client will be dropped.
Parameters
state
– Configures the address binding port state to enable or disable. When the state is
enabled, the port will perform the binding check.
strict
– This state provides a stricter method of control. If the user selects this mode, all
packets are blocked by the Switch by default. The Switch will compare all incoming ARP
and IP Packets and attempt to match them against the IMPB white list. If the IP-MAC pair
matches the white list entry, the packets from that MAC address are unblocked. If not, the
MAC address will stay blocked. While the Strict state uses more CPU resources from
checking every incoming ARP and IP packet, it enforces better security and is thus the
recommended setting.
The packet isn't found by the entry, the MAC will be set to block. Other packets will be
dropped. The default mode is strict if not specified.
loose
– This mode provides a looser way of control. If the user selects loose mode, the
Switch will forward all packets by default. However, it will still inspect incoming ARP
packets and compare them with the Switch’s IMPB white list entries. If the IP-MAC pair of
a packet is not found in the white list, the Switch will block the MAC address. A major
benefit of Loose state is that it uses less CPU resources because the Switch only checks
incoming ARP packets. However, it also means that Loose state cannot block users who
send only unicast IP packets. An example of this is that a malicious user can perform
DoS attacks by statically configuring the ARP table on their PC. In this case, the Switch
cannot block such attacks because the PC will not send out ARP packets.
allow_zeroip
– Specifies whether to allow ARP packets with Source IP address 0.0.0.0.
When enabled on a port, all ARP packets with a source IP address of 0.0.0.0 is
forwarded; when set to disable, they are blocked.
forward_dhcppkt
– By default, the Switch will forward all DHCP packets. However, if the
port state is set to Strict, all DHCP packets will be dropped. In that case, enable
forward_dhcppkt
so that the port will forward DHCP packets even under Strict state.
Enabling this feature also ensures that DHCP snooping works properly.
mode
– select to port to use
ARP
mode or
ACL
mode. When a port is under ACL mode,
the switch will create ACL access entry corresponding to the entries of this port. If the port
mode changes to ARP, all the ACL access entries will be deleted automatically. The
default mode of the port is ARP mode.
stop_learning_threshold<int>
– Enter a stop learning threshold between
0
and
500
.
Entering 500 means the port will enter the stop learning state after 500 illegal MAC
entries and will not allow additional MAC entries, both legal or illegal, to be learned on this
port. In the stop learning state, the port will also automatically purge all blocked MAC
entries on this port. Traffic from legal MAC entries are still forwarded. Entering
0
means
no limit has been set and the port will keep learning illegal MAC addresses.
<portlist>
−
Specifies a port or range of port to be configured. The port list is specified by
listing the lowest switch number and the beginning port number on that switch, separated
by a colon. Then the highest switch number, and the highest port number of the range
(also separated by a colon) are specified. The beginning and end of the port list range are
separated by a dash. For example, 1:3 specifies switch number 1, port 3. 2:4 specifies
switch number 2, port 4. 1:3–2:4 specifies all of the ports between switch 1, port 3 and
switch 2, port 4
−
in numerical order. Non–contiguous portlist entries are separated by a
comma. (ex: 1:1–1:3,1:7–1:9)
all
– Specifies all ports on the switch.
Restrictions
Only Administrator and Operator-level users can issue this command.
Example usage:
To configure address binding on the Switch:
