Netgear XCM8810 Chassis User Manual - Page 455

NETGEAR 8800 User Manual source IP lockdown is enabled on another port, the switch creates ACLs to allow DHCP packets and to deny all IP traffic for that particular port. Source IP lockdown is enabled on a per-port basis; it is not available at the VLAN level. If source IP lockdown is enabled on a port, the feature is active on the port for all VLANs to which the port belongs. Note: The source IP lockdown feature works only when hosts are assigned IP address using DHCP; source IP lockdown does not function for statically configured IP addresses. The source IP lockdown ACLs listed in table are applied per port (in order of precedence from highest to lowest.) Table 49. Source IP Lockdowns Applied Per-port ACL Name Match Condition esSrcIpLockdown__ esSrcIpLockdown__1 esSrcIpLockdown__2 esSrcIpLockdown__3 Proto UDP, Dest Port 67 Proto UDP, Dest Port 68 Ethertype ARP Action Permit Permit Permit Permit When Applied Comments Runtime Configuration time Configuration time Configuration time Multiple ACLs of this type can be applied, one for each permitted client. esSrcIpLockdown__4 All Deny + Configuration count time The counter has the same name as that of the rule of the catch-all ACL, so the counter is also named esSrcIpLockdown__4. Configuring Source IP Lockdown To configure source IP lockdown, you must enable DHCP snooping on the ports connected to the DHCP server and DHCP client before you enable source IP lockdown. You must enable source IP lockdown on the ports connected to the DHCP client, not on the ports connected to the DHCP server. To enable DHCP snooping, use the following command: enable ip-security dhcp-snooping {vlan} ports [all | ] violation-action [drop-packet {[block-mac | block-port] [duration | permanently] | none]}] {snmp-trap} Chapter 17. Security | 455