Brocade FastIron Ethernet Switch Security Configuration Gu Manual de usuario descargar pdf (Pagina 352)

device(config-vlan-2)#tag e1

Added tagged port(s) ethe 1 to port-vlan 2

device(config-vlan-2)#router-int ve 2

device(config-vlan-2)#int ve 2

device(config-vif-2)#source-guard enable e 1

Syntax: [no] source-guard enable

Enabling IP Source Guard to support a Multi-VRF instance

You can use IP Source Guard (IPSG) together with Dynamic ARP Inspection on untrusted ports. The

Brocade implementation of the IP Source Guard feature supports configuration on a port, on specific

VLAN memberships on a port (Layer 2 devices only), and on specific ports on a virtual interface (VE)

(Layer 3 devices only).To configure IP Source Guard to support a VRF instance, do the following:

• IPSG requires that the acl-per-port-per-vlan setting be enabled. To enable the setting:

Brocade(config)# enable acl-per-port-per-vlan

Reload required. Please write memory and then reload or power cycle.

Syntax: enable acl-per-port-per-vlan

• Configure IPSG:

‐ On a port using source-guard enable . For example:

Brocade(config)# interfacce ethernet 1/1

Brocade(config-if-e1000-1/1)# source-guard enable

Syntax: source-guard enable

• ‐ For Layer 2 devices, per port per VLAN using source-guard enable . For example:

Brocade(config-if-e1000-1/1)# per-vlan 2

Brocade(config-if-e1000-1/1-vlan-2)# source-guard enable

• ‐ For Layer 3 devices, per ve using source-guard enable . IPSG cannot be configured on

tagged ports or untagged ports which have a VE. For example:

Brocade(config)# interface ve 30

Brocade(config-vif-30)# source-guard enable ethernet 1/1

• ‐ Manually enter valid IP addresses in the binding database. For example:

Brocade(config)# ip source binding 1.1.1.2 ethernet 1/1 vlan 2

If the VLAN is not provided, it is applied on the port.

Displaying learned IP addresses

To display the learned IP addresses for IP Source Guard ports, use the CLI commands show ip

source-guard ethernet .

device(config)#show ip source-guard ethernet 1/1/37

Total number of IP Source Guard entries: 5

No Interface Type Flter-mode IP-address Vlan

-- --------- ---- ---------- ---------- ----

1 1/1/37 ip active 10.1.1.3 500

2 1/1/37 ip active 10.1.1.4 500

3 1/1/37 ip active 10.1.1.5 500

4 1/1/37 ip active 10.1.1.6 500

5 1/1/37 ip active 10.1.1.7 500

Syntax: show ip source-guard ethernet stack-unit/slotnum/portnum

Enabling IP Source Guard to support a Multi-VRF instance

352 FastIron Ethernet Switch Security Configuration Guide

53-1003088-03

1 2 ... 347 348 349 350 351 352 353 354 355 356 357 ... 395 396

Comentarios a estos manuales

Sin comentarios

Brocade FastIron Ethernet Switch Security Configuration Gu Manual de usuario Pagina 352

Comentarios a estos manuales

Relacionado con productos y manuales para Accesorios De Computador Brocade FastIron Ethernet Switch Security Configuration Gu