Edge-Core ECS4660-28F, Management Manual, Page: 440 / 2020

C
HAPTER
13
| Security Measures
IPv6 Source Guard
– 440 –
■
This parameter sets the maximum number of IPv6 global unicast
source IPv6 address entries that can be mapped to an interface in
the binding table, including both dynamic entries discovered by ND
snooping, DHCPv6 snooping (see the DHCPv6 Snooping
commands), and static entries set by IPv6 Source Guard (see
"Configuring Static Bindings for IPv6 Source Guard" on page 440 ).
■
IPv6 source guard maximum bindings must be set to a value higher
than DHCPv6 snooping maximum bindings and ND snooping
maximum bindings.
■
If IPv6 source guard, ND snooping, and DHCPv6 snooping are
enabled on a port, the dynamic bindings used by ND snooping,
DHCPv6 snooping, and IPv6 source guard static bindings cannot
exceed the maximum allowed bindings set by this parameter. In
other words, no new entries will be added to the IPv6 source guard
binding table.
■
If IPv6 source guard is enabled on a port, and the maximum
number of allowed bindings is changed to a lower value, precedence
is given to deleting entries learned through DHCPv6 snooping, ND
snooping, and then manually configured IPv6 source guard static
bindings, until the number of entries in the binding table reaches
the newly configured maximum number of allowed bindings.
W
EB
I
NTERFACE
To set the IPv6 Source Guard filter for ports:
1.
Click Security, IPv6 Source Guard, Port Configuration.
2.
Set the required filtering type for each port.
3.
Click Apply
Figure 229: Setting the Filter Type for IPv6 Source Guard
C
ONFIGURING
S
TATIC
B
INDINGS FOR
IP
V
6 S
OURCE
G
UARD
Use the Security > IPv6 Source Guard > Static Configuration page to bind
a static address to a port. Table entries include a MAC address, IPv6 global
unicast address, entry type (Static-IPv6-SG-Binding, Dynamic-ND-Binding,
Dynamic-DHCPv6-Binding), VLAN identifier, and port identifier.
CLI R
EFERENCES
◆ "ipv6 source-guard binding" on page 1140