Home » Dell Manuals » Servers » Dell Force10 E600i » Manual Viewer

Dell Force10 E600i FTOS Version 8.4.1.5 Configuration Guide for ExaScale - Page 323

IP Source Address Validation, DHCP MAC Source Address Validation, IP+MAC Source Address Validation

Add to My Manuals
Save this manual to your list of manuals

Page 323 highlights

IP Source Address Validation IP Source Address Validation (SAV) prevents IP spoofing by forwarding only IP packets that have been validated against the DHCP binding table. A spoofed IP packet is one in which the IP source address is strategically chosen to disguise the attacker. For example, using ARP spoofing an attacker can assume a legitimate client's identity and receive traffic addressed to it. Then the attacker can spoof the client's IP address to interact with other clients. The DHCP binding table associates addresses assigned by the DHCP servers, with the port on which the requesting client is attached. When IP Source Address Validation is enabled on a port, the system verifies that the source IP address is one that is associated with the incoming port. If an attacker is impostering as a legitimate client the source address appears on the wrong ingress port, and the system drops the packet. Likewise, if the IP address is fake, the address will not be on the list of permissible addresses for the port, and the packet is dropped. Task Enable IP Source Address Validation Command Syntax ip dhcp source-address-validation Command Mode INTERFACE DHCP MAC Source Address Validation DHCP MAC Source Address Validation (SAV) validates a DHCP packet's source hardware address against the client hardware address field (CHADDR) in the payload. FTOS Release 8.2.1.1 ensures that the packet's source MAC address is checked against the CHADDR field in the DHCP header only for packets from snooped VLANs. Task Enable DHCP MAC Source Address Validation. Command Syntax ip dhcp snooping verify mac-address Command Mode CONFIGURATION IP+MAC Source Address Validation c s IP+MAC Source Address Validation is available on platforms: IP Source Address Validation validates the IP source address of an incoming packet against the DHCP Snooping binding table. IP+MAC Source Address Validation ensures that the IP source address and MAC source address are a legitimate pair, rather validating each attribute individually. IP+MAC Source Address Validation cannot be configured with IP Source Address Validation. Step 1 2 3 4 Task Allocate at least one FP block to the ipmacacl CAM region. Save the running-config to the startup-config. Reload the system. Enable IP+MAC Source Address Validation. Command Syntax cam-acl l2acl Command Mode CONFIGURATION copy running-config startup-config reload ip dhcp source-address-validation ipmac EXEC Privilege EXEC Privilege INTERFACE Dynamic Host Configuration Protocol | 323

Section	Page
About this Guide	33
Objectives	33
Audience	33
Conventions	33
Information Symbols	34
Related Documents	34
Configuration Fundamentals	35
Accessing the Command Line	35
CLI Modes	36
CLI Modes in FTOS	37
Navigating CLI Modes	38
The do Command	40
Undoing Commands	40
Obtaining Help	41
Entering and Editing Commands	42
Command History	43
Filtering show Command Outputs	43
Multiple Users in Configuration mode	44
Getting Started	45
Default Configuration	46
Configure a Host Name	46
Access the System Remotely	47
Access the C-Series and E-Series Remotely	47
Access the S-Series Remotely	49
Configure the Enable Password	49
Configuration File Management	50
Copy Files to and from the System	50
Save the Running-configuration	52
View Files	53
File System Management	55
View command history	56
Upgrading FTOS	56
System Management	57
Configure Privilege Levels	57
Create a Custom Privilege Level	57
Apply a Privilege Level to a Username	60
Apply a Privilege Level to a Terminal Line	60
Configure Logging	61
Log Messages in the Logging Buffer	61
Configuration Task List for System Log Management	61
Disable System Logging	62
Send System Messages to a Syslog Server	62
Configure a Unix System as a Syslog Server	62
Change System Logging Settings	63
Display the Logging Buffer and the Logging Configuration	64
Configure a UNIX Logging Facility Level	65
Synchronize Log Messages	66
Enable Timestamp on Syslog Messages	66
File Transfer Services	67
Configuration Task List for File Transfer Services	67
Terminal Lines	68
Deny and Permit Access to a Terminal Line	68
Configure Login Authentication for Terminal Lines	69
Time out of EXEC Privilege Mode	70
Telnet to Another Network Device	71
Lock CONFIGURATION mode	71
Viewing the Configuration Lock Status	72
Recovering from a Forgotten Password	73
Recovering from a Forgotten Enable Password	74
Recovering from a Forgotten Password on S-Series	75
Recovering from a Failed Start	76
802.1ag	79
Ethernet CFM	79
Maintenance Domains	80
Maintenance Points	80
Maintenance End Points	81
Implementation Information	82
Configure CFM	82
Related Configuration Tasks	82
Enable Ethernet CFM	82
Create a Maintenance Domain	83
Create a Maintenance Association	83
Create Maintenance Points	84
Create a Maintenance End Point	84
Create a Maintenance Intermediate Point	85
MP Databases	85
Continuity Check Messages	86
Enable CCM	87
Enable Cross-checking	87
Loopback Message and Response	87
Linktrace Message and Response	88
Link Trace Cache	88
Enable CFM SNMP Traps.	89
Display Ethernet CFM Statistics	91
802.3ah	93
Link Layer OAM Overview	93
Link Layer OAMPDUs	94
Link Layer OAM Operational Modes	95
Link Layer OAM Discovery	95
Link Layer OAM Events	96
Remote Loopback	96
Implementation Information	96
Configure Link Layer OAM	97
Related Configuration Tasks	97
Enable Link Layer OAM	97
Adjust the OAMPDU Transmission Parameters	98
Link Performance Event Monitoring	98
Enable Error Monitoring	99
Set Threshold Values	99
Execute an Action upon Exceeding the High Threshold	101
Remote Failure Indication	101
Remote Loopback	102
Display Link Layer OAM Configuration and Statistics	103
Manage Link Layer OAM	105
Enable MIB Retrieval Support/Function	105
Adjust the Size of the Link OAM Event Log	105
802.1X	107
Protocol Overview	107
The Port-authentication Process	109
EAP over RADIUS	110
Configuring 802.1X	111
Related Configuration Tasks	111
Important Points to Remember	112
Enabling 802.1X	112
Configuring Request Identity Re-transmissions	114
Configuring a Quiet Period after a Failed Authentication	115
Forcibly Authorizing or Unauthorizing a Port	116
Re-Authenticating a Port	117
Periodic Re-Authentication	117
Configuring Timeouts	118
Dynamic VLAN Assignment with Port Authentication	119
Guest and Authentication-Fail VLANs	120
Configuring a Guest VLAN	120
Configuring an Authentication-Fail VLAN	121
Multi-Host Authentication	122
Multi-Supplicant Authentication	124
MAC Authentication Bypass	126
MAB in Single-host and Multi-Host Mode	127
MAB in Multi-Supplicant Authentication Mode	127
Dynamic CoS with 802.1X	129
IP Access Control Lists (ACL), Prefix Lists, and Route-maps	131
Overview	131
IP Access Control Lists (ACLs)	132
CAM Profiling, CAM Allocation, and CAM Optimization	132
Implementing ACLs on FTOS	135
IP Fragment Handling	136
Configure a standard IP ACL	138
Configure an extended IP ACL	141
Configuring Layer 2 and Layer 3 ACLs on an Interface	144
Assign an IP ACL to an Interface	145
Counting ACL Hits	146
Configuring Ingress ACLs	146
Configuring Egress ACLs	147
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	148
Configuring ACLs to Loopback	148
Applying an ACL on Loopback Interfaces	149
IP Prefix Lists	150
Implementation Information	150
Configuration Task List for Prefix Lists	151
ACL Resequencing	154
Resequencing an ACL or Prefix List	155
Route Maps	157
Implementation Information	157
Important Points to Remember	157
Configuration Task List for Route Maps	158
Bidirectional Forwarding Detection	165
Protocol Overview	165
How BFD Works	166
Important Points to Remember	171
Configuring Bidirectional Forwarding Detection	171
Configuring BFD for Physical Ports	171
Configuring BFD for Static Routes	175
Configuring BFD for OSPF	177
Configuring BFD for IS-IS	180
Configuring BFD for VRRP	182
Configuring BFD for VLANs	186
Configuring BFD for Port-Channels	188
Configuring Protocol Liveness	190
Troubleshooting BFD	190
Border Gateway Protocol IPv4 (BGPv4)	191
Protocol Overview	192
Autonomous Systems (AS)	192
Sessions and Peers	195
Route Reflectors	196
Confederations	197
BGP Attributes	197
Best Path Selection Criteria	197
Weight	200
Local Preference	200
Multi-Exit Discriminators (MEDs)	201
Origin	202
AS Path	202
Next Hop	203
Multiprotocol BGP	203
Implementing BGP with FTOS	203
Additional Path (Add-Path) support	203
4-Byte AS Numbers	205
AS4 Number Representation	205
AS Number Migration	207
BGP4 Management Information Base (MIB)	209
Important Points to Remember	209
Configuration Information	210
BGP Configuration	211
Configuration Task List for BGP	212
MBGP Configuration	249
BGP Regular Expression Optimization	250
Retain NH in BGP Advertisement	250
Debugging BGP	250
Storing Last and Bad PDUs	251
Capturing PDUs	252
PDU Counters	254
Sample Configurations	254
Content Addressable Memory	265
Content Addressable Memory	266
CAM Profiles	266
Microcode	268
CAM Profiling for ACLs	269
Boot Behavior	270
When to Use CAM Profiling	271
Important Points to Remember	271
Select CAM Profiles	272
CAM Allocation	273
Test CAM Usage	274
View CAM Profiles	274
View CAM-ACL settings	275
View CAM Usage	276
Configure IPv4Flow Sub-partitions	276
Configure Ingress Layer 2 ACL Sub-partitions	278
Return to the Default CAM Configuration	280
CAM Optimization	281
Applications for CAM Profiling	281
LAG Hashing	281
LAG Hashing based on Bidirectional Flow	281
CAM profile for the VLAN ACL group feature	281
Troubleshoot CAM Profiling	282
CAM Profile Mismatches	282
QoS CAM Region Limitation	282
Content Addressable Memory for ExaScale	285
Content Addressable Memory	285
Static Random Access Memory	286
CAM-profile templates	286
Default CAM-profile	288
Recommended CAM-profile templates	288
CAM/SRAM region minimums and maximums	290
Microcode	291
Boot Behavior	292
Select a CAM-profile template	292
Select pre-defined CAM-profile template	293
Create new CAM-profile	294
Assign a microcode to the CAM-profile template	295
Validate CAM-profile templates	295
Show CAM-profile templates	295
Configuration Replace and Rollback	299
Archived Files	299
Configuring Configuration Replace and Rollback	300
Related Configuration Tasks	300
Important Points to Remember	300
Enabling the Archive Service	300
Archiving a Configuration File	301
Viewing the Archive Directory	301
Replacing the Current Running Configuration	302
Rolling Back to the Previous Configuration	302
Configuring an Archive File Maximum	303
Configuring Auto-archive	304
Copying and Deleting an Archive File	305
Viewing and Editing the Contents of an Archive File	305
Viewing the Difference between Configuration Files	306
Dynamic Host Configuration Protocol	307
Protocol Overview	307
DHCP Packet Format and Options	307
Assigning an IP Address using DHCP	309
Implementation Information	310
Configuration Tasks	310
Configure the System to be a DHCP Server	310
Configuration Tasks	311
Configure the Server for Automatic Address Allocation	311
Specify a Default Gateway	313
Enable DHCP Server	313
Configure a Method of Hostname Resolution	314
Create Manual Binding Entries	314
Debug DHCP server	315
DHCP Clear Commands	315
Configure the System to be a Relay Agent	316
Configure Secure DHCP	317
Option 82	317
DHCP Snooping	318
Drop DHCP packets on snooped VLANs only	320
Dynamic ARP Inspection	320
Source Address Validation	322
Equal Cost Multi-Path	325
ECMP for Flow-based Affinity	325
Configurable Hash Algorithm	325
Deterministic ECMP Next Hop	325
Configurable Hash Algorithm Seed	326
Force10 Resilient Ring Protocol	329
Protocol Overview	329
Ring Status	330
Multiple FRRP Rings	331
Important FRRP Points	332
Important FRRP Concepts	333
Implementing FRRP	334
FRRP Configuration	335
Troubleshooting FRRP	339
Configuration Checks	339
Sample Configuration and Topology	339
Force10 Service Agent	343
Implementation Information	343
Configure Force10 Service Agent	344
Related Configuration Tasks	344
Enable Force10 Service Agent	344
Specify an SMTP Server for FTSA	345
Provide an Administrator E-mail Address	345
FTSA Messaging Service	346
Enable the FTSA Messaging Service	346
Add Additional Recipients of FTSA E-mails	347
Encrypt FTSA Messages	348
Provide Administrator Contact Information	348
Set the Frequency of FTSA Type 3 Messages	349
Generate FTSA Type 4 Messages	349
Set Parameters FTSA Type 5 Messages	349
FTSA Message Types	350
FTSA Policies	352
Create an FTSA Policy Test List	353
Create a Policy Action List	355
Create a Policy and Assign a Test and Action List	358
Additional Policy Configurations	358
FTSA Policy Sample Configurations	359
Debugging FTSA	365
GARP VLAN Registration Protocol	367
Protocol Overview	367
Important Points to Remember	367
Configuring GVRP	368
Related Configuration Tasks	369
Enabling GVRP Globally	369
Enabling GVRP on a Layer 2 Interface	369
Configuring GVRP Registration	370
Configuring a GARP Timer	371
High Availability	373
Component Redundancy	374
RPM Redundancy	374
Online Insertion and Removal	381
RPM Online Insertion and Removal	381
Line Card Online Insertion and Removal	382
Hitless Behavior	384
Graceful Restart	384
Software Resiliency	385
Runtime System Health Check	385
SFM Channel Monitoring	385
Software Component Health Monitoring	386
System Health Monitoring	386
Failure and Event Logging	386
Hot-lock Behavior	387
Warm Upgrade	388
Configure Cache Boot	388
In-Service Modular Hot-Fixes	392
Process Restartability	393
Internet Group Management Protocol	397
IGMP Implementation Information	397
IGMP Protocol Overview	397
IGMP version 2	398
IGMP version 3	399
Configuring IGMP	402
Related Configuration Tasks	402
Viewing IGMP Enabled Interfaces	403
Selecting an IGMP Version	403
Viewing IGMP Groups	404
Adjusting Timers	404
Adjusting Query and Response Timers	404
Adjusting the IGMP Querier Timeout Value	405
Configuring a Static IGMP Group	405
Enabling IGMP Immediate-leave	405
IGMP Snooping	406
IGMP Snooping Implementation Information	406
Configuring IGMP Snooping	406
Enabling IGMP Immediate-leave	407
Disabling Multicast Flooding	407
Specifying a Port as Connected to a Multicast Router	407
Configuring the Switch as Querier	408
Fast Convergence after MSTP Topology Changes	408
Designating a Multicast Router Interface	409
Interfaces	411
Interface Types	412
View Basic Interface Information	412
Enable a Physical Interface	414
Physical Interfaces	414
Configuration Task List for Physical Interfaces	415
Overview of Layer Modes	415
Configure Layer 2 (Data Link) Mode	416
Configure Layer 3 (Network) Mode	416
Management Interfaces	418
Configure Management Interfaces on the E-Series and C-Series	418
Configure Management Interfaces on the S-Series	419
Displaying Information on a Management Interface	420
VLAN Interfaces	421
Loopback Interfaces	422
Null Interfaces	422
Port Channel Interfaces	423
Bulk Configuration	434
Interface Range	434
Bulk Configuration Examples	435
Interface Range Macros	436
Define the Interface Range	436
Choose an Interface-range Macro	437
Monitor and Maintain Interfaces	437
Maintenance using TDR	438
Link Debounce Timer	439
Important Points to Remember about Link Debounce Timer	439
Assign a debounce time to an interface	440
Show debounce times in an interface	440
Disable ports when one only SFM is available (E300 only)	440
Disable port on one SFM	441
Link Dampening	441
Important Points to Remember	441
Enable Link Dampening	441
Ethernet Pause Frames	443
Threshold Settings	444
Enable Pause Frames	444
Configure MTU Size on an Interface	445
Port-pipes	446
Auto-Negotiation on Ethernet Interfaces	447
View Advanced Interface Information	450
Display Only Configured Interfaces	450
Configure Interface Sampling Size	451
Dynamic Counters	452
IPv4 Addressing	455
IP Addresses	456
Implementation Information	456
Configuration Task List for IP Addresses	456
Directed Broadcast	460
Resolution of Host Names	460
ARP	463
Configuration Task List for ARP	463
ARP Learning via Gratuitous ARP	466
ARP Learning via ARP Request	466
Configurable ARP Retries	467
ICMP	468
Configuration Task List for ICMP	468
UDP Helper	469
Configuring UDP Helper	469
Important Points to Remember about UDP Helper	469
Enabling UDP Helper	470
Configuring a Broadcast Address	470
Configurations Using UDP Helper	471
UDP Helper with Broadcast-all Addresses	471
UDP Helper with Subnet Broadcast Addresses	472
UDP Helper with Configured Broadcast Addresses	472
UDP Helper with No Configured Broadcast Addresses	473
Troubleshooting UDP Helper	473
IPv6 Addressing	475
Protocol Overview	476
Extended Address Space	476
Stateless Autoconfiguration	476
IPv6 Headers	477
Extension Header fields	479
Addressing	481
Implementing IPv6 with FTOS	482
ICMPv6	484
Path MTU Discovery	485
IPv6 Neighbor Discovery	486
IPv6 Neighbor Discovery of MTU packets	486
Advertise Neighbor Prefixes	487
QoS for IPv6	487
IPv6 Multicast	487
SSH over an IPv6 Transport	488
Configuration Task List for IPv6	488
Change your CAM-Profile on an E-Series system	489
Adjust your CAM-Profile on an C-Series or S-Series	490
Assign an IPv6 Address to an Interface	491
Assign a Static IPv6 Route	491
Telnet with IPv6	492
SNMP over IPv6	492
Show IPv6 Information	492
Show an IPv6 Interface	493
Show IPv6 Routes	494
Show the Running-Configuration for an Interface	496
Clear IPv6 Routes	496
Intermediate System to Intermediate System	497
Protocol Overview	498
IS-IS Addressing	498
Multi-Topology IS-IS	499
Transition Mode	500
Interface support	500
Adjacencies	500
Graceful Restart	500
Implementation Information	501
Configuration Information	502
Configuration Task List for IS-IS	503
Configuring the distance of a route	512
Change the IS-type	512
IS-IS Metric Styles	520
Configure Metric Values	520
Maximum Values in the Routing Table	520
Changing the IS-IS Metric Style in One Level Only	521
Leaking from One Level to Another	522
Sample Configuration	523
Link Aggregation Control Protocol	529
Introduction to Dynamic LAGs and LACP	529
Important Points to Remember	530
LACP modes	531
LACP Configuration Commands	531
LACP Configuration Tasks	532
Monitor and Debugging LACP	534
Shared LAG State Tracking	534
Configure Shared LAG State Tracking	535
Important Points about Shared LAG State Tracking	536
Configure LACP as Hitless	536
LACP Basic Configuration Example	537
Layer 2	545
Managing the MAC Address Table	545
Clear the MAC Address Table	545

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158

Match case Limit results 1 per page

Dynamic Host Configuration Protocol

323

IP Source Address Validation

IP Source Address Validation (SAV) prevents IP spoofing by forwarding only IP packets that have been

validated against the DHCP binding table. A spoofed IP packet is one in which the IP source address is

strategically chosen to disguise the attacker. For example, using ARP spoofing an attacker can assume a

legitimate client’s identity and receive traffic addressed to it. Then the attacker can spoof the client’s IP

address to interact with other clients.

The DHCP binding table associates addresses assigned by the DHCP servers, with the port on which the

requesting client is attached. When IP Source Address Validation is enabled on a port, the system verifies

that the source IP address is one that is associated with the incoming port. If an attacker is impostering as a

legitimate client the source address appears on the wrong ingress port, and the system drops the packet.

Likewise, if the IP address is fake, the address will not be on the list of permissible addresses for the port,

and the packet is dropped.

DHCP MAC Source Address Validation

DHCP MAC Source Address Validation (SAV) validates a DHCP packet’s source hardware address

against the client hardware address field (CHADDR) in the payload.

FTOS Release 8.2.1.1 ensures that the packet’s source MAC address is checked against the CHADDR

field in the DHCP header only for packets from snooped VLANs.

IP+MAC Source Address Validation

is available on platforms:

c s

IP Source Address Validation validates the IP source address of an incoming packet against the DHCP

Snooping binding table. IP+MAC Source Address Validation ensures that the IP source address and MAC

source address are a legitimate pair, rather validating each attribute individually. IP+MAC Source Address

Validation cannot be configured with IP Source Address Validation.

Task

Command Syntax

Command Mode

Enable IP Source Address Validation

ip dhcp source-address-validation

INTERFACE

Task

Command Syntax

Command Mode

Enable DHCP MAC Source Address Validation.

ip dhcp snooping verify mac-address

CONFIGURATION

Step

Task

Command Syntax

Command Mode

Allocate at least one FP block to the ipmacacl

CAM region.

cam-acl l2acl

CONFIGURATION

Save the running-config to the startup-config.

copy running-config startup-config

EXEC Privilege

Reload the system.

reload

EXEC Privilege

Enable IP+MAC Source Address Validation.

ip dhcp source-address-validation

ipmac

INTERFACE