Zte ZXA10 C300 - Configuring the Service Gateway MAC Anti-Spoofing

Chapter14AccessSecurityConguration
4.(Optional)QuerythecongurationofMACaddressanti-spoong.
ZXAN(config)#showsecuritymac-anti-spoofingconfiguration
mac-move-report:enable
mac-move-reportinterval:30[minutes]
mac-anti-spoofing:enable
uplink-protect:disable
5.(Optional)QuerytheMACmovelog.
ZXAN#showsecuritymac-move-log
Flag*--macMoveisforbiddenbysystem.
thetotalmac-move-lognum:2
-------------------------------------------------------------------------
mac-addressvlancfgMacProtectmoveToPortmoveToIfIdmoveCount
indextrapFlagdetectorqueryPortmoveFromPortmoveFromIfIdtrapCount
-------------------------------------------------------------------------
0002.0304.0506100UNNEEDinner-port_1/12/1unknown(0)1
1SENDEDMPUNNEEDinner-port_1/5/1unknown(0)1
-------------------------------------------------------------------------
0002.0304.0507100UNNEEDinner-port_1/12/2unknown(0)1
2*SENDEDMPUNNEEDinner-port_1/5/1unknown(0)1
–EndofSteps–
14.2.2ConfiguringtheServiceGatewayMACAnti-Spoofing
ServicegatewayMACaddressanti-spoongpreventsmaliciousMACaddressspoong
betweenuserportsandpermitsMACaddresslearningbetweenuplinkports.
Context
TheZXA10C300supportsthefollowingfeaturesbyservicegatewayMACanti-spoong:
lAMACaddresslearntbyauserportcanbelearntbyanuplinkportaswell.
lThesameMACaddresscannotbelearntbytwouserports.
lThesameMACaddresscanbelearntbymultipleuplinkports.
Steps
1.EnableglobalMACaddressanti-spoongfunction.
ZXAN(config)#securitymac-anti-spoofingenable
2.EnableMACaddressanti-spoongfunctionwithuplinkprotection.
ZXAN(config)#securitymac-anti-spoofinguplink-protectenable
3.(Optional)QuerythecongurationofMACaddressanti-spoong.
ZXAN(config)#showsecuritymac-anti-spoofingconfiguration
14-9
SJ-20130520164529-007|2013-06-30(R1.0)ZTEProprietaryandCondential