C
HAPTER
25
| General Security Measures
IPv6 Source Guard
– 927 –
interface
ethernet unit/port
unit - Unit identifier. (Range: 1)
port - Port number. (Range: 1-28)
DEFAULT SETTING
No configured entries
COMMAND MODE
Global Configuration
COMMAND USAGE
â—† Table entries include an associated MAC address, IPv6 global unicast
address, entry type (Static-IPv6-SG-Binding, Dynamic-ND-Snooping,
Dynamic-DHCPv6-Snooping), VLAN identifier, and port identifier.
â—† Traffic filtering is based only on the source IPv6 address, VLAN ID, and
port number.
â—† All static entries are configured with an infinite lease time, which is
indicated with a value of zero by the show ipv6 source-guard command
(page 930).
â—† When source guard is enabled, traffic is filtered based upon dynamic
entries learned via ND snooping, DHCPv6 snooping, or static addresses
configured in the source guard binding table with this command.
â—† Static bindings are processed as follows:
â–
If there is no entry with same and MAC address and IPv6 address, a
new entry is added to binding table using static IPv6 source guard
binding.
â–
If there is an entry with same MAC address and IPv6 address, and
the type of entry is static IPv6 source guard binding, then the new
entry will replace the old one.
â–
If there is an entry with same MAC address and IPv6 address, and
the type of the entry is either a dynamic ND snooping binding or
DHCPv6 snooping binding, then the new entry will replace the old
one and the entry type will be changed to static IPv6 source guard
binding.
â–
Only unicast addresses are accepted for static bindings.
EXAMPLE
This example configures a static source-guard binding on port 5.
Console(config)#ipv6 source-guard binding 00-ab-11-cd-23-45 vlan 1 2001::1
interface ethernet 1/5
Console(config)#
To Next Page
Loading...
Need help?
General
