IES Interface Commands
Page 942 7750 SR OS Services Guide
This command is typically used with MSAPs where advertising the subnet prior to having a MSAP
dynamically created is needed.
allow-directed-broadcasts
Syntax [no] allow-directed-broadcasts
Context config>service>ies>interface
Description This command enables the forwarding of directed broadcasts out of the IP interface.
A directed broadcast is a packet received on a local router interface destined for the subnet broadcast
address on another IP interface. The allow-directed-broadcasts command on an IP interface enables
or disables the transmission of packets destined to the subnet broadcast address of the egress IP
interface.
When enabled, a frame destined to the local subnet on this IP interface will be sent as a subnet
broadcast out this interface. Care should be exercised when allowing directed broadcasts as it is a
well-known mechanism used for denial-of-service attacks.
When disabled, directed broadcast packets discarded at this egress IP interface will be counted in the
normal discard counters for the egress SAP.
By default, directed broadcasts are not allowed and will be discarded at this egress IP interface.
The no form of this command disables the forwarding of directed broadcasts out of the IP interface.
Default no allow-directed-broadcasts — Directed broadcasts are dropped.
anti-spoof
Syntax anti-spoof {ip | mac | ip-mac}
no anti-spoof
Context config>service>ies>if>sap
Description This command enables anti-spoof filtering and optionally changes the anti-spoof matching type for
the SAP.
The type of anti-spoof filtering defines what information in the incoming packet is used to generate
the criteria to lookup an entry in the anti-spoof filter table. The type parameter (ip, ip-mac, nh-mac)
defines the anti-spoof filter type enforced by the SAP when anti-spoof filtering is enabled.
The no form of the command disables anti-spoof filtering on the SAP.
Default no anti-spoof
Parameters ip — Configures SAP anti-spoof filtering to use only the source IP address in its lookup. If a static
host exists on the SAP without an IP address specified, the anti-spoof type ip command will fail.
mac — Configures SAP anti-spoof filtering to use only the source MAC address in its lookup.
Setting the anti-spoof filter type to mac is not allowed on non-Ethernet encapsulated SAPs. If a
static host exists on the SAP without a specified MAC address, the anti-spoof type mac
To Next Page
Loading...
