Chapter 14 Access Security Configuration
ZXAN(config)#interface gpon-onu_1/5/1:2
ZXAN(config-if)#ip-source-guard ip-limit ipv4 2 ipv6 4
3.
Configure the service port VLAN.
ZXAN(config-if)#service-port 1 vport 1 user-vlan 100 vlan 200
4.
Enable the IP source guard on the service port.
ZXAN(config-if)#ip-source-guard enable sport 1
5.
Configure the IPv4 DHCP snooping static binding.
ZXAN(config-if)#ip dhcp snooping binding 1.1.1.2 sport 1
6.
Configure the IPv6 DHCP snooping static binding.
ZXAN(config-if)#ipv6 dhcp snooping binding mac-address 2365.1498.2369 2001::ff01
ipv6-mask 128 sport 1
7.
(Optional) Query the IP source guard status.
ZXAN(config)#show ip-source-guard
global ip-source-guard status :enable
8.
(Optional) Query the IPv4 DHCP snooping static binding.
ZXAN(config-if)#show ip dhcp snooping static port gpon-onu_1/5/1:2
Port
Sport
IP-addr
MAC-addr
gpon-onu_1/5/1:2
1
1.1.1.2
0000.0000.0000
9.
(Optional) Query the IPv6 DHCP snooping static binding.
ZXAN(config-if)#show ipv6 dhcp snooping static port gpon-onu_1/5/1:2
Port
Sport
IPv6-addr
Mask MAC-addr
gpon-onu_1/5/1:2
1
2001::ff01
128
2365.1498.2369
– End of Steps –
14.6 Configuring MFF
This section describes how to configure MFF to implement layer-3 interworking between
subscribers and prevent malicious attacks.
Context
The MAC forced forwarding (
) function prohibits interworking between two subscribers
in the same subnet and forcedly forwards the upstream flows of the subscribers to the
gateway. The gateway then forwards the flows to implement layer-3 interworking between
subscribers. The gateway can analyze traffic between subscribers to prevent malicious
attacks.
Steps
1.
Enable MFF.
ZXAN(config)#ip-service mac-forced-forwarding enable
14-13
SJ-20130520164529-007|2013-06-30 (R1.0)
ZTE Proprietary and Confidential