HP E3800 Series, Access Security Manual

Page: 537 / 732

11-27
Configuring Advanced Threat Protection
Dynamic IP Lockdown
Adding an IP-to-MAC Binding to the DHCP Binding
Database
A switch maintains a DHCP binding database, which is used for dynamic IP
lockdown as well as for DHCP and ARP packet validation. The DHCP snooping
feature maintains the lease database by learning the IP-to-MAC bindings of
VLAN traffic on untrusted ports. Each binding consists of the client MAC
address, port number, VLAN identifier, leased IP address, and lease time.
Dynamic IP lockdown supports a total of 4K static and dynamic bindings with
up to 64 bindings per port. When DHCP snooping is enabled globally on a
VLAN, dynamic bindings are learned when a client on the VLAN obtains an IP
address from a DHCP server. Static bindings are created manually with the
CLI or from a downloaded configuration file.
When dynamic IP lockdown is enabled globally or on ports the bindings
associated with the ports are written to hardware. This occurs during these
events:
■ Switch initialization
■ Hot swap
■ A dynamic IP lockdown-enabled port is moved to a DHCP snooping-
enabled VLAN
■ DHCP snooping or dynamic IP lockdown characteristics are changed
such that dynamic IP lockdown is enabled on the ports
Potential Issues with Bindings
■ When dynamic IP lockdown enabled, and a port or switch has the
maximum number of bindings configured, the client DHCP request
will be dropped and the client will not receive an IP address through
DHCP.
■ When dynamic IP lockdown is enabled and a port is configured with
the maximum number of bindings, adding a static binding to the port
will fail.
■ When dynamic IP lockdown is enabled globally, the bindings for each
port are written to hardware. If global dynamic IP lockdown is
enabled and disabled several times, it is possible to run out of buffer
space for additional bindings. The software will delay adding the
bindings to hardware until resources are available.