Ip Source Guard; Security At Layer 2 - Avaya 8800 Planning And Engineering, Network Design

Network security
Important:
For Dynamic ARP inspection to function, you must enable DHCP snooping globally and on the
VLAN. For information on DHCP snooping, see
DHCP snooping dynamically creates and maintains a binding table gathered from DHCP requests
and replies. The MAC address from the DHCP request is paired with the IP address from the DHCP
reply to create an entry in the DHCP binding table.
When you enable Dynamic ARP inspection, ARP packets on untrusted ports are filtered based on
the source MAC and IP addresses. The switch forwards an ARP packet when the source MAC and
IP addresses match an entry in the address binding table. Otherwise, the ARP packet is dropped.
Like DHCP snooping, Dynamic ARP Inspection supports MLT/SMLT ports as trusted ports only.
For more information about Dynamic ARP Inspection, see Avaya Ethernet Routing Switch
8800/8600 Security (NN46205-601).

IP Source Guard

IP Source Guard is a security feature that validates IP packets by intercepting IP packets with
invalid IP-to-MAC bindings.
IP Source Guard works closely with DHCP snooping and prevents IP spoofing by allowing only IP
addresses that are obtained through DHCP on a particular port. Initially, all IP traffic on the port is
blocked except for the DHCP packets that are captured by DHCP snooping. When a client receives
a valid IP address from the DHCP server, traffic on the port is permitted when the source IP and
MAC addresses match a DCHP binding table entry for the port. Any IP traffic that does not match an
entry in the DHCP binding table is filtered out. This filtering limits the ability of a host to attack the
network by claiming a neighbor host's IP address.
Important:
For IP Source Guard to function, you must enable DHCP snooping and Dynamic ARP
Inspection globally and at the VLAN level. To enable IP Source Guard on a port, the port must
be configured as untrusted for DHCP snooping and untrusted for Dynamic ARP Inspection.
IP Source Guard cannot be enabled on MLT/SMLT ports.
For more information about IP Source Guard, see Avaya Ethernet Routing Switch 8800/8600
Security (NN46205-601).

Security at layer 2

At Layer 2, the Avaya Ethernet Routing Switch 8800/8600 provides the following security
mechanisms:
• Filters
June 2016
DHCP snooping
Planning and Engineering — Network Design
Comments on this document? infodev@avaya.com
on page 274.
276