Juniper JUNOS OS 10.3 - SOFTWARE Manual page 2986

Complete Software Guide for Junos
Configuration
CLI Quick
Configuration
Step-by-Step
Procedure
2890
®
OS for EX Series Ethernet Switches, Release 10.3
The topology for this example includes one EX-3200-24P switch, a PC and an IP phone
connected on the same interface, a connection to a DHCP server, and a connection to a
RADIUS server for user authentication.
NOTE: The 802.1X user authentication applied in this example is for single
supplicants. Single-secure supplicant mode and multiple supplicant mode
do not work with IP source guard. For more information about 802.1X
authentication, see "Understanding Authentication on EX Series Switches"
on page 2526.
TIP: You can set the
debugging purposes.
This example shows how to configure a static IP address to be added to the
DHCP snooping database.
To quickly configure IP source guard on a data VLAN, copy the following commands and
paste them into the switch terminal window:
set ethernet-switching-options voip interface ge-0/0/14.0 vlan voice
set ethernet-switching-options secure-access-port interface ge-0/0/24.0 dhcp-trusted
set ethernet-switching-options secure-access-port interface ge-0/0/14 static-ip 11.1.1.1 mac
00:11:11:11:11:11 vlan data
set ethernet-switching-options secure-access-port vlan data examine-dhcp
set ethernet-switching-options secure-access-port vlan data ip-source-guard
set interfaces ge-0/0/24 unit 0 family ethernet-switching vlan members data
set vlans voice vlan-id 100
set protocols lldp-med interface ge-0/0/14.0
set protocols dot1x authenticator authentication-profile-name profile52
set protocols dot1x authenticator interface ge-0/0/14.0 supplicant single
To configure IP source guard on the data VLAN:
Configure the VoIP interface:
1.
[edit ethernet-switching-options]
user@switch# set voip interface ge-0/0/14.0 vlan voice
Configure the interface on which the DHCP server is connected to the switch as a
2.
trusted interface and add that interface to the data VLAN:
[edit ethernet-switching-options]
user@switch# set secure-access-port interface ge-0/0/24.0 dhcp-trusted
[edit interfaces]
user@switch# set ge-0/0/24 unit 0 family ethernet-switching vlan members data
Configure a static IP address on an interface on the data VLAN (optional)
3.
[edit ethernet-switching-options]
user@switch# set secure-access-port interface ge-0/0/14 static-ip 11.1.1.1 mac
00:11:11:11:11:11 vlan data
flag in the
ip-source-guard
Copyright © 2010, Juniper Networks, Inc.
statement for
traceoptions