Configuring Port Security (Cli Procedure) - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Complete Software Guide for Junos

Configuring Port Security (CLI Procedure)

2906
®
OS for EX Series Ethernet Switches, Release 10.3
Ethernet LANs are vulnerable to attacks such as address spoofing and Layer 2 denial of
service (DoS) on network devices. Port security features such as DHCP snooping, DAI
(dynamic ARP inspection), MAC limiting, and MAC move limiting, as well as trusted DHCP
server, help protect the access ports on your EX Series switch against the losses of
information and productivity that can result from such attacks.
To configure port security features using the CLI:
Enable DHCP snooping:
1.
On a specific VLAN:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan default examine-dhcp
On all VLANs:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan all examine-dhcp
Enable DAI:
2.
On a single VLAN (here, the VLAN is
[edit ethernet-switching-options secure-access-port]
user@switch# set vlan employee–vlan arp-inspection
On all VLANs:
[edit ethernet-switching-options secure-access-port]
user@switch# set vlan all arp-inspection
Limit the number of dynamic MAC addresses and specify the action to take if the limit
3.
is exceeded—for example, set a MAC limit of
On a single interface (here, the interface is
[edit ethernet-switching-options secure-access-port]
user@switch# set interface ge–0/0/1 mac-limit 5 action drop
On all interfaces:
[edit ethernet-switching-options secure-access-port]
user@switch# set interface all mac–limit 5 action drop
Specify allowed MAC addresses:
4.
On a single interface (here, the interface is
[edit ethernet-switching-options secure-access-port]
user@switch# set interface ge–0/0/2 allowed-mac 00:05:85:3A:82:80
user@switch# set interface ge–0/0/2 allowed-mac 00:05:85:3A:82:81
user@switch# set interface ge–0/0/2 allowed-mac 00:05:85:3A:82:83
On all interfaces:
employee-vlan ):
5 with an action of drop
):
ge-0/0/1
):
ge-0/0/2
Copyright © 2010, Juniper Networks, Inc.
: