Example: Configuring Ip Source Guard With Other J-Ex Series Switch Features To Mitigate Address-Spoofing Attacks On Untrusted Access Interfaces - Dell PowerConnect J-EX4200-24T Software Manual

Dell PowerConnect J-Series Ethernet Switch Complete Software Guide for Junos OS
Action
Meaning
Purpose
Action
Meaning
Related
Documentation
Example: Configuring IP Source Guard with Other J-EX Series Switch Features to
Mitigate Address-Spoofing Attacks on Untrusted Access Interfaces
2600
Send some ARP requests from network devices connected to the switch.
Display the DAI information:
user@switch1> show arp inspection statistics
ARP inspection statistics:
Interface Packets received
---------- –-------------–-
ge-0/0/1.0
ge-0/0/2.0
ge-0/0/3.0
The sample output shows the number of ARP packets received and inspected per
interface, with a listing of how many packets passed and how many failed the inspection
on each interface. The switch compares the ARP requests and replies against the entries
in the DHCP snooping database. If a MAC address or IP address in the ARP packet does
not match a valid entry in the database, the packet is dropped.
Verifying That MAC Limiting Is Working Correctly on Switch 1
Verify that MAC limiting is working on Switch 1.
Display the MAC addresses that are learned when DHCP requests are sent from hosts
on ge-0/0/1 :
user@switch1> show ethernet-switching table
Ethernet-switching table:
VLAN MAC address
employee-vlan 00:05:85:3A:82:77
employee-vlan 00:05:85:3A:82:79
employee-vlan 00:05:85:3A:82:80
employee-vlan 00:05:85:3A:82:81
employee-vlan 00:05:85:3A:82:83
employee-vlan *
The sample output shows that five MAC addresses have been learned for interface
, which corresponds to the MAC limit of
ge-0/0/1
of the output shows that a sixth MAC address request was dropped, as indicated by the
asterisk (*) in the
MAC address
Example: Configuring Port Security, with DHCP Snooping, DAI, MAC Limiting, and MAC
Move Limiting, on a J-EX Series Switch on page 2569
Configuring Port Security (CLI Procedure) on page 2626
Configuring Port Security (J-Web Procedure) on page 2627
Ethernet LAN switches are vulnerable to attacks that involve spoofing (forging) of source
IP addresses or source MAC addresses. These spoofed packets are sent from hosts
ARP inspection pass
-------------------
7 5
10 10
18 15
6 entries, 5 learned
Type
Learn
Learn
Learn
Learn
Learn
Flood
set in the configuration. The last line
5
column.
ARP inspection failed
---------------------
2
0
3
Age Interfaces
0 ge-0/0/1.0
0 ge-0/0/1.0
0 ge-0/0/1.0
0 ge-0/0/1.0
0 ge-0/0/1.0
- ge-0/0/1.0