Device-Tracking Policy - Cisco Catalyst 3650 series Command Reference Manual

device-tracking policy

To configure a Switch Integrated Security Features (SISF)-based IP device tracking policy, use the
device-tracking command in global configuration mode. To delete a device tracking policy, use the no form
of this command.
device -tracking policy policy-name
no device-tracking policy policy-name
Syntax Description
policy-name
Command Default
A device tracking policy is not configured.
Command Modes
Global configuration
Command History
Release
Cisco IOS XE Denali 16.1.1
Usage Guidelines
Use the SISF-based device-tracking policy command to create a device tracking policy. When the
device-tracking policy command is enabled, the configuration mode changes to device-tracking configuration
mode. In this mode, the administrator can configure the following first-hop security commands:
• (Optional) device-role{node] | switch}—Specifies the role of the device attached to the port. Default
• (Optional) limit address-count value—Limits the number of addresses allowed per target.
• (Optional) no—Negates a command or sets it to defaults.
• (Optional) destination-glean{recovery| log-only}[dhcp]}—Enables binding table recovery by data
• (Optional) data-glean{recovery| log-only}[dhcp | ndp]}—Enables binding table recovery using source
• (Optional) security-level{glean|guard|inspect}—Specifies the level of security enforced by the feature.
User-defined name of the device tracking policy. The policy name can be a
symbolic string (such as Engineering) or an integer (such as 0).
is node.
traffic source address gleaning.
or data address gleaning.
Default is guard.
glean—Gleans addresses from messages and populates the binding table without any verification.
guard—Gleans addresses and inspects messages. In addition, it rejects RA and DHCP server
messages. This is the default option.
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
device-tracking policy
Modification
This command was introduced.
745