HP E3800 Series, Access Security Manual

Page: 529 / 732

11-19
Configuring Advanced Threat Protection
Dynamic ARP Protection
Adding an IP-to-MAC Binding to the DHCP Database
A routing switch maintains a DHCP binding database, which is used for DHCP
and ARP packet validation. Both the DHCP snooping and DHCP Option 82
insertion features maintain the lease database by learning the IP-to-MAC
bindings on untrusted ports. Each binding consists of the client MAC address,
port number, VLAN identifier, leased IP address, and lease time.
If your network does not use DHCP or if some network devices have fixed,
user-configured IP addresses, you can enter static IP-to-MAC address bindings
in the DHCP binding database. The switch uses manually configured static
bindings for DHCP snooping and dynamic ARP protection.
To add the static configuration of an IP-to-MAC binding for a port to the
database, enter the
ip source-binding
command at the global configuration
level.
An example of the
ip source-binding
command is shown here:
HP Switch(config)# ip source-binding 0030c1-7f49c0
interface vlan 100 10.10.20.1 interface 4
N o t e
Note that the
ip source-binding
command is the same command used by the
Dynamic IP Lockdown feature to configure static bindings. The Dynamic ARP
Protection and Dynamic IP Lockdown features share a common list of source
IP-to-MAC bindings.
Syntax: [no] ip source-binding < mac-address > vlan < vlan-id > < ip-address >
interface < port-number >
mac-address
Specifies a MAC address to bind with a VLAN
and IP address on the specified port in the
DHCP binding database.
vlan <vlan-id>
Specifies a VLAN ID number to bind with the
specified MAC and IP addresses on the speci-
fied port in the DHCP binding database.
ip-address
Specifies an IP address to bind with a VLAN
and MAC address on the specified port in the
DHCP binding database.
interface
<port-number>
Specifies the port number on which the IP-to-
MAC address and VLAN binding is configured
in the DHCP binding database.