Juniper JUNOS OS 10.3 - SOFTWARE, Manual

Page: 2979 / 3946

set ethernet-switching-options secure-access-port vlan data arp-inspection
set ethernet-switching-options secure-access-port vlan data ip-source-guard
set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members data
set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members data
set interfaces ge-0/0/24 unit 0 family ethernet-switching vlan members data
set protocols lldp-med interface ge-0/0/0.0
set protocols dot1x authenticator authentication-profile-name profile52
set protocols dot1x authenticator interface ge-0/0/0.0 supplicant single
set protocols lldp-med interface ge-0/0/1.0
set protocols dot1x authenticator interface ge-0/0/1.0 supplicant single
Step-by-Step
Procedure
To configure IP source guard with 802.1X authentication and various port security features:
1.
Configure the interface on which the DHCP server is connected to the switch as a
trusted interface and add that interface to the data VLAN:
[edit ethernet-switching-options]
user@switch#
set secure-access-port interface ge-0/0/24 dhcp-trusted
user@switch#
set set ge-0/0/24 unit 0 family ethernet-switching vlan members data
2.
Associate two interfaces with the data VLAN:
[edit interfaces]
user@switch#
set ge-0/0/0 unit 0 family ethernet-switching vlan members data
user@switch# set ge-0/0/1 unit 0 family ethernet-switching vlan members data
3.
Configure 802.1X user authentication and LLDP-MED on the two interfaces that
you associated with the data VLAN:
[edit protocols]
user@switch#
set lldp-med interface ge-0/0/0.0
user@switch#
set dot1x authenticator authentication-profile-name profile52
user@switch# set dot1x authenticator interface ge-0/0/0.0 supplicant single
user@switch# set lldp-med interface ge-0/0/1.0
user@switch# set dot1x authenticator interface ge-0/0/1.0 supplicant single
4.
Configure three access port security features—DHCP snooping, dynamic ARP
inspection (DAI), and IP source guard—on the data VLAN:
[edit ethernet-switching-options]
user@switch#
set secure-access-port vlan data examine-dhcp
user@switch# set secure-access-port vlan data arp-inspection
user@switch#
set secure-access-port vlan data ip-source-guard
Results Check the results of the configuration:
[edit ethernet-switching-options]
secure-access-port {
interface ge-0/0/24.0 {
dhcp-trusted;
}
vlan data {
arp-inspection;
examine-dhcp;
ip-source-guard;
}
}
[edit interfaces]
2883 Copyright © 2010, Juniper Networks, Inc.
Chapter 94: Examples: Port Security Configuration