Home » Dell Manuals » Servers » Dell Force10 S25-01-GE-24V » Manual Viewer

Dell Force10 S25-01-GE-24V FTOS 8.4.2.6 Configuraiton Guide for the E-Series T - Page 343

Bypass the ARP Inspection, Source Address Validation

View all Dell Force10 S25-01-GE-24V manuals

Add to My Manuals
Save this manual to your list of manuals

Page 343 highlights

View the number of entries in the ARP database with the show arp inspection database command. Figure 14-8. Command example: show arp inspection database Force10#show arp inspection database Protocol Address Age(min) Hardware Address Interface VLAN CPU Internet 10.1.1.251 - 00:00:4d:57:f2:50 Gi 0/2 Vl 10 CP Internet 10.1.1.252 - 00:00:4d:57:e6:f6 Gi 0/1 Vl 10 CP Internet 10.1.1.253 - 00:00:4d:57:f8:e8 Gi 0/3 Vl 10 CP Internet 10.1.1.254 - 00:00:4d:69:e8:f2 Te 0/50 Vl 10 CP Force10# Use show arp inspection statistics command to see how many valid and invalid ARP packets have been processed. Figure 14-9. Command example: show arp inspection database Force10#show arp inspection statistics Dynamic ARP Inspection (DAI) Statistics Valid ARP Requests Valid ARP Replies Invalid ARP Requests Invalid ARP Replies Force10# : 0 : 1000 : 1000 : 0 Bypass the ARP Inspection You can configure a port to skip ARP inspection by defining the interface as trusted, which is useful in multi-switch environments. ARPs received on trusted ports bypass validation against the binding table. All ports are untrusted by default. Task Specify an interface as trusted so that ARPs are not validated against the binding table. Command Syntax arp inspection-trust Command Mode INTERFACE FTOS Behavior: Introduced in FTOS version 8.2.1.0, Dynamic ARP Inspection (DAI) was available for Layer 3 only. FTOS version 8.2.1.1 extends DAI to Layer 2. Source Address Validation Using the DHCP binding table, FTOS can perform three types of source address validation (SAV): • IP Source Address Validation on page 344 prevents IP spoofing by forwarding only IP packets that have been validated against the DHCP binding table. Dynamic Host Configuration Protocol | 343

Section	Page
About this Guide	35
Objectives	35
Audience	35
Conventions	36
Information Symbols	36
Related Documents	36
Configuration Fundamentals	37
Accessing the Command Line	37
CLI Modes	38
Navigating CLI Modes	39
The do Command	42
Undoing Commands	42
Obtaining Help	43
Entering and Editing Commands	43
Command History	44
Filtering show Command Outputs	45
Multiple Users in Configuration mode	46
Getting Started	47
Default Configuration	48
Configure a Host Name	49
Access the System Remotely	49
Access the C-Series and E-Series Remotely	49
Configure the Management Port IP Address	50
Configure a Management Route	50
Configure a Username and Password	50
Access the S-Series Remotely	51
Configure the Enable Password	52
Configuration File Management	52
Copy Files to and from the System	53
Important Points to Remember	53
Save the Running-configuration	54
View Files	55
View Configuration Files	56
File System Management	57
View command history	58
Upgrading and Downgrading FTOS	58
System Management	59
Configure Privilege Levels	59
Create a Custom Privilege Level	59
Removing a command from EXEC mode	60
Move a command from EXEC Privilege mode to EXEC mode	60
Allow Access to CONFIGURATION mode commands	60
Allow Access to INTERFACE, LINE, ROUTE-MAP, and ROUTER mode	60
Apply a Privilege Level to a Username	63
Apply a Privilege Level to a Terminal Line	63
Configure Logging	63
Log Messages in the Logging Buffer	64
Configuration Task List for System Log Management	64
Disable System Logging	64
Send System Messages to a Syslog Server	65
Configure a Unix System as a Syslog Server	65
Change System Logging Settings	65
Display the Logging Buffer and the Logging Configuration	66
Configure a UNIX Logging Facility Level	68
Synchronize Log Messages	69
Enable Timestamp on Syslog Messages	69
File Transfer Services	70
Configuration Task List for File Transfer Services	70
Enable FTP server	70
Configure FTP server parameters	70
Configure FTP client parameters	71
Terminal Lines	71
Deny and Permit Access to a Terminal Line	71
Configure Login Authentication for Terminal Lines	72
Time out of EXEC Privilege Mode	73
Telnet to Another Network Device	74
Lock CONFIGURATION mode	74
Viewing the Configuration Lock Status	75
Recovering from a Forgotten Password	76
Recovering from a Forgotten Enable Password	77
Recovering from a Forgotten Password on S-Series	78
Recovering from a Failed Start	79
802.1ag	81
Ethernet CFM	81
Maintenance Domains	82
Maintenance Points	82
Maintenance End Points	83
Implementation Information	84
Configure CFM	84
Related Configuration Tasks	84
Enable Ethernet CFM	85
Create a Maintenance Domain	85
Create a Maintenance Association	86
Create Maintenance Points	86
Create a Maintenance End Point	86
Create a Maintenance Intermediate Point	87
MP Databases	87
MP Database Persistence	88
Continuity Check Messages	89
Enable CCM	90
Enable Cross-checking	90
Loopback Message and Response	90
Linktrace Message and Response	90
Link Trace Cache	91
Enable CFM SNMP Traps.	92
Display Ethernet CFM Statistics	93
802.3ah	95
Link Layer OAM Overview	95
Link Layer OAMPDUs	96
OAMPDU Flags	96
Link Layer OAM Operational Modes	97
Link Layer OAM Discovery	97
Link Layer OAM Events	98
Remote Loopback	98
Implementation Information	98
Configure Link Layer OAM	99
Related Configuration Tasks	99
Enable Link Layer OAM	99
Adjust the OAMPDU Transmission Parameters	101
Link Performance Event Monitoring	101
Enable Error Monitoring	101
Set Threshold Values	102
Symbol Errors per Second	102
Frame Errors per Second	103
Frame Errors per Frame Period	103
Error Seconds per Time Period	103
Execute an Action upon Exceeding the High Threshold	104
Remote Failure Indication	104
Remote Loopback	105
Display Link Layer OAM Configuration and Statistics	106
Manage Link Layer OAM	108
Enable MIB Retrieval Support/Function	108
Adjust the Size of the Link OAM Event Log	108
802.1X	109
Protocol Overview	109
The Port-authentication Process	111
EAP over RADIUS	112
RADIUS Attributes for 802.1 Support	113
Configuring 802.1X	113
Related Configuration Tasks	113
Important Points to Remember	114
Enabling 802.1X	114
Configuring Request Identity Re-transmissions	116
Configuring a Quiet Period after a Failed Authentication	116
Forcibly Authorizing or Unauthorizing a Port	117
Re-Authenticating a Port	118
Periodic Re-Authentication	118
Configuring Timeouts	119
Dynamic VLAN Assignment with Port Authentication	121
Guest and Authentication-Fail VLANs	123
Configuring a Guest VLAN	123
Configuring an Authentication-Fail VLAN	124
Multi-Host Authentication	125
Multi-Supplicant Authentication	127
MAC Authentication Bypass	129
MAB in Single-host and Multi-Host Mode	130
MAB in Multi-Supplicant Authentication Mode	130
Dynamic CoS with 802.1X	132
IP Access Control Lists (ACL), Prefix Lists, and Route-maps	135
Overview	135
IP Access Control Lists (ACLs)	136
CAM Profiling, CAM Allocation, and CAM Optimization	136
CAM Profiling	137
User Configurable CAM Allocation	138
CAM optimization	138
Test CAM Usage	138
Implementing ACLs on FTOS	139
ACLs and VLANs	139
ACL Optimization	139
Determine the order in which ACLs are used to classify traffic	140
IP Fragment Handling	140
IP fragments ACL examples	141
Layer 4 ACL rules examples	141
Configure a standard IP ACL	142
Configure an extended IP ACL	145
Configure filters with sequence number	145
Configure filters without sequence number	147
Established Flag	148
Configuring Layer 2 and Layer 3 ACLs on an Interface	148
Assign an IP ACL to an Interface	149
Counting ACL Hits	150
Configuring Ingress ACLs	151
Configuring Egress ACLs	151
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	152
Configuring ACLs to Loopback	153
Applying an ACL on Loopback Interfaces	153
IP Prefix Lists	155
Implementation Information	155
Configuration Task List for Prefix Lists	155
Configure a prefix list	156
Use a prefix list for route redistribution	158
ACL Resequencing	159
Resequencing an ACL or Prefix List	160
Route Maps	162
Implementation Information	162
Important Points to Remember	163
Configuration Task List for Route Maps	163
Create a route map	163
Configure route map filters	165
Configure a route map for route redistribution	168
Configure a route map for route tagging	169
Continue clause	169
Bidirectional Forwarding Detection	171
Protocol Overview	171
How BFD Works	172
BFD packet format	172
BFD sessions	175
BFD three-way handshake	175
Session state changes	176
Important Points to Remember	177
Configuring Bidirectional Forwarding Detection	177
Configuring BFD for Physical Ports	178
Related configuration tasks	178
Enabling BFD globally	178
Establishing a session on physical ports	178
Changing physical port session parameters	180
Disabling and re-enabling BFD	181
Configuring BFD for Static Routes	182
Related configuration tasks	182
Establishing sessions for static routes	182
Changing static route session parameters	183
Disabling BFD for static routes	183
Configuring BFD for OSPF	184
Related configuration tasks	184
Establishing sessions with OSPF neighbors	184
Changing OSPF session parameters	186
Disabling BFD for OSPF	186
Configuring BFD for BGP	187
Prerequisites	187
Establishing sessions with BGP neighbors	187
Disabling BFD for BGP	189
Using BFD in a BGP Peer Group	189
Displaying BFD for BGP Information	190
Configuring BFD for IS-IS	195
Related configuration tasks	195
Establishing sessions with IS-IS neighbors	195
Changing IS-IS session parameters	196
Disabling BFD for IS-IS	197
Configuring BFD for VRRP	197
Related configuration tasks	197
Establishing sessions with all VRRP neighbors	197
Establishing VRRP sessions on VRRP neighbors	198
Changing VRRP session parameters	199
Disabling BFD for VRRP	200
Configuring BFD for VLANs	200
Related configuration tasks	201
Establishing sessions with VLAN neighbors	201
Changing session parameters	202
Disabling BFD for VLANs	202
Configuring BFD for Port-Channels	203
Related configuration tasks	203
Establishing sessions on port-channels	203
Changing port-channel session parameters	204
Disabling BFD for port-channels	204
Configuring Protocol Liveness	205
Troubleshooting BFD	205
Border Gateway Protocol IPv4 (BGPv4)	207
Protocol Overview	208
Autonomous Systems (AS)	208
Sessions and Peers	210
Establishing a session	210
Peer Groups	211
Route Reflectors	211
Confederations	212
Communities	212
BGP Attributes	213
Best Path Selection Criteria	213
Best Path selection details	214
Weight	216
Local Preference	216
Multi-Exit Discriminators (MEDs)	216
Origin	217
AS Path	218
Next Hop	219
Multiprotocol BGP	219
Implementing BGP with FTOS	219
Advertise IGP cost as MED for redistributed routes	219
Ignore Router-ID for some best-path calculations	220
4-Byte AS Numbers	220
AS4 Number Representation	221
Dynamic AS Number Notation application	222
AS Number Migration	223
BGP4 Management Information Base (MIB)	225
Important Points to Remember	225
Configuration Information	226
BGP Configuration	227
Defaults	227
Configuration Task List for BGP	227
Enable BGP	228
Configure AS4 Number Representations	232
Configure Peer Groups	234
BGP fast fall-over	237
Configure passive peering	240
Maintain existing AS numbers during an AS migration	241
Allow an AS number to appear in its own AS path	242
Enable graceful restart	243
Filter on an AS-Path attribute	245
Redistribute routes	248
Configure IP community lists	249
Manipulate the COMMUNITY attribute	252
Change MED attribute	253
Change LOCAL_PREFERENCE attribute	254
Change NEXT_HOP attribute	255
Change WEIGHT attribute	255
Enable multipath	256
Filter BGP routes	256
Configure BGP route reflectors	259
Aggregate routes	260
Configure BGP confederations	260
Enable route flap dampening	261
Change BGP timers	265
BGP neighbor soft-reconfiguration	265
Route map continue	267
MBGP Configuration	268
BGP Regular Expression Optimization	269
Retain NH in BGP Advertisement	269
Debugging BGP	269
Storing Last and Bad PDUs	270
Capturing PDUs	271
PDU Counters	273
Sample Configurations	273
Content Addressable Memory	283
Content Addressable Memory	284
CAM Profiles	284
Microcode	286
CAM Profiling for ACLs	287
Boot Behavior	288
When to Use CAM Profiling	289
Important Points to Remember	290
Differences Between EtherScale and TeraScale	290
Select CAM Profiles	290
CAM Allocation	291
Test CAM Usage	292
View CAM Profiles	293
View CAM-ACL settings	293
View CAM Usage	294
Configure IPv4Flow Sub-partitions	295
Configure Ingress Layer 2 ACL Sub-partitions	297
Return to the Default CAM Configuration	299
CAM Optimization	300
Applications for CAM Profiling	300
LAG Hashing	300
LAG Hashing based on Bidirectional Flow	301
CAM profile for the VLAN ACL group feature	301
Troubleshoot CAM Profiling	301
CAM Profile Mismatches	301
QoS CAM Region Limitation	302
Content Addressable Memory for ExaScale	303
Content Addressable Memory	303
Static Random Access Memory	304
CAM-profile templates	304
Default CAM-profile	305
Recommended CAM-profile templates	306
CAM/SRAM region minimums and maximums	307
Microcode	308
Boot Behavior	309
Select a CAM-profile template	310
Select pre-defined CAM-profile template	310
Create new CAM-profile	312
Assign a microcode to the CAM-profile template	313
Validate CAM-profile templates	313
Show CAM-profile templates	313
Configuration Replace and Rollback	317
Archived Files	317
Configuring Configuration Replace and Rollback	318
Related Configuration Tasks	318
Important Points to Remember	318
Enabling the Archive Service	318
Archiving a Configuration File	319
Viewing the Archive Directory	319
Replacing the Current Running Configuration	319
Rolling Back to the Previous Configuration	320
Configuring an Archive File Maximum	321
Configuring Auto-archive	322
Copying and Deleting an Archive File	323
Viewing and Editing the Contents of an Archive File	323
Viewing the Difference between Configuration Files	324
Dynamic Host Configuration Protocol	327
Protocol Overview	327
DHCP Packet Format and Options	328
Assigning an IP Address using DHCP	329
Implementation Information	330
Configuration Tasks	330
Configure the System to be a DHCP Server	330
Configuration Tasks	331
Related Configuration Tasks	331
Configure the Server for Automatic Address Allocation	331
Create an IP Address Pool	331
Exclude Addresses from the Address Pool	332
Specify an Address Lease Time	332
Specify a Default Gateway	332
Enable DHCP Server	333
Configure a Method of Hostname Resolution	333
Address Resolution using DNS	333
Address Resolution using NetBIOS WINS	334
Allocate Addresses to BOOTP Clients	334
Create Manual Binding Entries	334
Check for Address Conflicts	335
DHCP Clear Commands	336
Configure the System to be a Relay Agent	336
Configure Secure DHCP	337
Option 82	338
DHCP Snooping	338
Enable DCHP snooping	339
Add a static entry in the binding table	340
Clear the binding table	340
Display the contents of the binding table	340
Drop DHCP packets on snooped VLANs only	341
Dynamic ARP Inspection	341
Bypass the ARP Inspection	343
Source Address Validation	343
IP Source Address Validation	344
DHCP MAC Source Address Validation	344
IP+MAC Source Address Validation	344
Equal Cost Multi-Path	347
ECMP for Flow-based Affinity (E-Series)	347
Configurable Hash Algorithm (E-Series)	347
Deterministic ECMP Next Hop	348
Configurable Hash Algorithm Seed	348
Configurable ECMP Hash Algorithm (C- and S-Series)	350
Force10 Resilient Ring Protocol	351
Protocol Overview	351
Ring Status	352
Ring Checking	352
Ring Failure	353
Ring Restoration	353
Multiple FRRP Rings	353
Member VLAN Spanning Two Rings Connected by One Switch	353
Important FRRP Points	354
Important FRRP Concepts	355
Implementing FRRP	356
FRRP Configuration	357
Create the FRRP group	357
Configure the Control VLAN	357
Configure and add the Member VLANs	359
Set FRRP Timers	360
Clear FRRP counters	360
Show FRRP configuration	361
Show FRRP information	361
Troubleshooting FRRP	361
Configuration Checks	361
Sample Configuration and Topology	361
Force10 Service Agent	363
Implementation Information	363
Configure Force10 Service Agent	364
Related Configuration Tasks	364
Enable Force10 Service Agent	364
Specify an SMTP Server for FTSA	365
Provide an Administrator E-mail Address	365
FTSA Messaging Service	366
Enable the FTSA Messaging Service	366
Add Additional Recipients of FTSA E-mails	367
Encrypt FTSA Messages	368
Create a PGP5 encryption key	369
Provide Administrator Contact Information	369
Set the Frequency of FTSA Type 3 Messages	370
Generate FTSA Type 4 Messages	370
Set Parameters FTSA Type 5 Messages	370
FTSA Message Types	371
FTSA Policies	373
Create an FTSA Policy Test List	374
Choose test conditions for a policy test list	374
Set the match criterion for test lists	377
Create a Policy Action List	377
Add actions to a policy action list	378
Create a Policy and Assign a Test and Action List	379
Additional Policy Configurations	380
FTSA Policy Sample Configurations	380
Line card state-change policy configuration	380
Excessive CRC-error policy configuration	385
Debugging FTSA	387
GARP VLAN Registration Protocol	389
Protocol Overview	389
Important Points to Remember	389
Configuring GVRP	390
Related Configuration Tasks	391
Enabling GVRP Globally	391
Enabling GVRP on a Layer 2 Interface	392
Configuring GVRP Registration	392
Configuring a GARP Timer	393
High Availability	395
Component Redundancy	396
RPM Redundancy	396
Boot the chassis with a single RPM	396
Boot the chassis with dual RPMs	397
Automatic and manual RPM failover	398
Communication between RPMs	399
Support for RPM redundancy by FTOS version	400
RPM synchronization	401
RPM redundancy configuration tasks	401
Online Insertion and Removal	403
RPM Online Insertion and Removal	403
Line Card Online Insertion and Removal	403
Pre-configure a line card slot	404
Replace a line card	405
Hitless Behavior	405
Graceful Restart	406
Software Resiliency	406
Runtime System Health Check	407
SFM Channel Monitoring	407
Software Component Health Monitoring	408
System Health Monitoring	408
Failure and Event Logging	408
Trace Log	408
Core Dumps	408
System Log	409
Hot-lock Behavior	409
Warm Upgrade	409
Configure Cache Boot	410
Cache Boot Pre-requisites	410