Dell PowerConnect 6248 Configuration Guide - Page 173

NSF and DHCP Snooping, If Dynamic ARP Inspection is enabled on the access switch

Get Dell PowerConnect 6248 PDF manuals and user guides View all Dell PowerConnect 6248 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 173 highlights

Figure 9-3. NSF and DHCP Snooping Hosts ` ` ` LAG ` ` Hosts DHCP Server If the management unit fails, all hosts connected to that unit lose network access until that unit reboots. The hardware on surviving units continues to enforce source filters IPSG installed prior to the failover. Valid hosts continue to communicate normally. During the failover, the hardware continues to drop data packets from unauthorized hosts so that security is not compromised. If a host is in the middle of an exchange with the DHCP server when the failover occurs, the exchange is interrupted while the control plane restarts. When DHCP snooping is enabled, the hardware traps all DHCP packets to the CPU. The control plane drops these packets during the restart. The DHCP client and server retransmit their DHCP messages until the control plane has resumed operation and messages get through. Thus, DHCP snooping does not miss any new bindings during a failover. As DHCP snooping applies its checkpointed DHCP bindings, IPSG confirms the existence of the bindings with the hardware by reinstalling its source IP address filters. If Dynamic ARP Inspection is enabled on the access switch, the hardware traps ARP packets to the CPU on untrusted ports. During a restart, the control plane drops ARP packets. Thus, new traffic sessions may be briefly delayed until after the control plane restarts. If IPSG is enabled and a DHCP binding is not checkpointed to the backup unit before the failover, that host will not be able to send data packets until it renews its IP address lease with the DHCP server. Utility 173

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
Utility
173
Figure 9-3.
NSF and DHCP Snooping
If the management unit fails, all hosts connected to that unit lose network access until that unit reboots.
The hardware on surviving units continues to enforce source filters IPSG installed prior to the failover.
Valid hosts continue to communicate normally. During the failover, the hardware continues to drop data
packets from unauthorized hosts so that security is not compromised.
If a host is in the middle of an exchange with the DHCP server when the failover occurs, the exchange is
interrupted while the control plane restarts. When DHCP snooping is enabled, the hardware traps all
DHCP packets to the CPU. The control plane drops these packets during the restart. The DHCP client
and server retransmit their DHCP messages until the control plane has resumed operation and messages
get through. Thus, DHCP snooping does not miss any new bindings during a failover.
As DHCP snooping applies its checkpointed DHCP bindings, IPSG confirms the existence of the
bindings with the hardware by reinstalling its source IP address filters.
If Dynamic ARP Inspection is enabled on the access switch, the hardware traps ARP packets to the CPU
on untrusted ports. During a restart, the control plane drops ARP packets. Thus, new traffic sessions may
be briefly delayed until after the control plane restarts.
If IPSG is enabled and a DHCP binding is not checkpointed to the backup unit before the failover, that
host will not be able to send data packets until it renews its IP address lease with the DHCP server.
DHCP Server
LAG
`
`
`
`
`
Hosts
Hosts