Ipv6 Source-Guard Max-Binding - Edge-Core ECS4120-28F Reference Manual

◆
Example
This example enables IP source guard on port 5.
Related Commands
ipv6 source-guard binding (338)
ipv6 dhcp snooping (321)
ipv6 dhcp snooping vlan (326)
ipv6 source-guard
This command sets the maximum number of entries that can be bound to an
interface. Use the no form to restore the default setting.
max-binding
Syntax
Default Setting
5
Filtering rules are implemented as follows:
If ND snooping and DHCPv6 snooping are disabled, IPv6 source guard will
■
check the VLAN ID, source IPv6 address, and port number. If a matching
entry is found in the binding table and the entry type is static IPv6 source
guard binding, the packet will be forwarded.
If ND snooping or DHCPv6 snooping is enabled, IPv6 source guard will
■
check the VLAN ID, source IP address, and port number. If a matching entry
is found in the binding table and the entry type is static IPv6 source guard
binding, dynamic ND snooping binding, or dynamic DHCPv6 snooping
binding, the packet will be forwarded.
If IPv6 source guard is enabled on an interface for which IPv6 source
■
bindings (dynamically learned via ND snooping or DHCPv6 snooping, or
manually configured) are not yet configured, the switch will drop all IPv6
traffic on that port, except for ND packets and DHCPv6 packets allowed by
DHCPv6 snooping.
Only IPv6 global unicast addresses are accepted for static bindings.
■
Console(config)#interface ethernet 1/5
Console(config-if)#ipv6 source-guard sip
Console(config-if)#
ipv6 source-guard max-binding number
no ipv6 source-guard max-binding
number - The maximum number of IPv6 addresses that can be mapped to
an interface in the binding table. (Range: 1-5)
– 341 –
Chapter 9
| General Security Measures
IPv6 Source Guard