Juniper JUNOS OS 10.3 - SOFTWARE, Manual

Page: 2955 / 3946

allowed-mac [ 00:05:85:3a:82:80 00:05:85:3a:82:81 00:05:85:3a:82:83 00:05:85
:3a:82:85 ];
}
Verification
To confirm that the configuration is working properly:
• Verifying That MAC Limiting Is Working Correctly on the Switch on page 2859
Verifying That MAC Limiting Is Working Correctly on the Switch
Purpose Verify that MAC limiting is working on the switch.
Action Display the MAC cache information after DHCP requests have been sent from hosts on
ge-0/0/1 , with the interface set to a MAC limit of 4 with the action drop , and after four
allowed MAC addresses have been configured on interface ge/0/0/2 :
user@switch>
show ethernet-switching table
Ethernet-switching table: 5 entries, 4 learned
VLAN MAC address Type Age Interfaces
employee-vlan 00:05:85:3A:82:71 Learn 0 ge-0/0/1.0
employee-vlan 00:05:85:3A:82:74 Learn 0 ge-0/0/1.0
employee-vlan 00:05:85:3A:82:77 Learn 0 ge-0/0/1.0
employee-vlan 00:05:85:3A:82:79 Learn 0 ge-0/0/1.0
employee-vlan * Flood 0 ge-0/0/1.0
employee-vlan 00:05:85:3A:82:80 Learn 0 ge-0/0/2.0
employee-vlan 00:05:85:3A:82:81 Learn 0 ge-0/0/2.0
employee-vlan 00:05:85:3A:82:83 Learn 0 ge-0/0/2.0
employee-vlan 00:05:85:3A:82:85 Learn 0 ge-0/0/2.0
employee-vlan * Flood - ge-0/0/2.0
Meaning The sample output shows that with a MAC limit of 4 for the interface, the DHCP request
for a fifth MAC address on ge-0/0/1 was dropped because it exceeded the MAC limit
and that only the specified allowed MAC addresses have been learned on the ge-0/0/2
interface.
Related
Documentation
Example: Configuring Port Security, with DHCP Snooping, DAI, MAC Limiting, and MAC
Move Limiting, on an EX Series Switch on page 2849
•
•
Configuring MAC Limiting (CLI Procedure) on page 2915
•
Configuring MAC Limiting (J-Web Procedure) on page 2917
Example: Configuring a DHCP Server Interface as Untrusted to Protect the Switch from
Rogue DHCP Server Attacks
In a rogue DHCP server attack, an attacker has introduced a rogue server into the network,
allowing it to give IP address leases to the network's DHCP clients and to assign itself as
the gateway device.
2859 Copyright © 2010, Juniper Networks, Inc.
Chapter 94: Examples: Port Security Configuration