Edge-Core ECS4660-28F Management Manual page 440

| Security Measures
C 13
HAPTER
IPv6 Source Guard
C
ONFIGURING
S B
TATIC INDINGS FOR
IP 6 S G
V OURCE UARD
This parameter sets the maximum number of IPv6 global unicast
■
source IPv6 address entries that can be mapped to an interface in
the binding table, including both dynamic entries discovered by ND
snooping, DHCPv6 snooping (see the
commands), and static entries set by IPv6 Source Guard (see
"Configuring Static Bindings for IPv6 Source Guard" on page
IPv6 source guard maximum bindings must be set to a value higher
■
than DHCPv6 snooping maximum bindings and ND snooping
maximum bindings.
If IPv6 source guard, ND snooping, and DHCPv6 snooping are
■
enabled on a port, the dynamic bindings used by ND snooping,
DHCPv6 snooping, and IPv6 source guard static bindings cannot
exceed the maximum allowed bindings set by this parameter. In
other words, no new entries will be added to the IPv6 source guard
binding table.
If IPv6 source guard is enabled on a port, and the maximum
■
number of allowed bindings is changed to a lower value, precedence
is given to deleting entries learned through DHCPv6 snooping, ND
snooping, and then manually configured IPv6 source guard static
bindings, until the number of entries in the binding table reaches
the newly configured maximum number of allowed bindings.
W I
EB NTERFACE
To set the IPv6 Source Guard filter for ports:
Click Security, IPv6 Source Guard, Port Configuration.
1.
Set the required filtering type for each port.
2.
Click Apply
3.
Figure 229: Setting the Filter Type for IPv6 Source Guard
Use the Security > IPv6 Source Guard > Static Configuration page to bind
a static address to a port. Table entries include a MAC address, IPv6 global
unicast address, entry type (Static-IPv6-SG-Binding, Dynamic-ND-Binding,
Dynamic-DHCPv6-Binding), VLAN identifier, and port identifier.
CLI R
EFERENCES
"ipv6 source-guard binding" on page 1140
◆
– 440 –
DHCPv6 Snooping
440).