Table 372: Port Security Settings On Vlans - Juniper JUNOS OS 10.3 - SOFTWARE Manual

Complete Software Guide for Junos

Table 372: Port Security Settings on VLANs

Field Function
Enable DHCP Allows the switch to monitor and control
Snooping on DHCP messages received from untrusted
VLAN devices connected to the switch. Builds and
maintains a database of valid IP
addresses/MAC address bindings. (By
default, access ports are untrusted and trunk
ports are trusted.)
Enable ARP Uses information in the DHCP snooping
Inspection on database to validate ARP packets on the
VLAN LAN and protect against ARP cache
poisoning.
MAC Movement Specifies the number of times per second
that a MAC address can move to a new
interface.
MAC Movement Specifies the action to be taken if the MAC
Action move limit is exceeded.
2908
®
OS for EX Series Ethernet Switches, Release 10.3
NOTE: After you make changes to the configuration in this page, you must
commit the changes for them to take effect. To commit all changes to
the active configuration, select
Commit Options to Commit Configuration Changes for details about all
commit options.
Click one:
2.
—Click this option to modify the security features for the selected port or VLAN.
Edit
Enter information as specified in Table 372 on page 2908 to modify Port Security
settings on VLANs.
Enter information as specified in Table 373 on page 2909 to modify Port Security
settings on interfaces.
Activate/Deactivate
Commit Options
—Click this option to enable or disable security on the switch.
Your Action
Select to enable DHCP snooping on a specified VLAN or all
VLANs.
TIP: For private VLANs (PVLANs), enable DHCP snooping
on the primary VLAN. If you enable DHCP snooping only on
a community VLAN, DHCP messages coming from PVLAN
trunk ports are not snooped.
Select to enable ARP inspection on a specified VLAN or all
VLANs. (Configure any port on which you do not want ARP
inspection to occur as a trusted DHCP server port.)
Enter a number. The default is unlimited.
Select one:
Log—Generate a system log entry, an SNMP trap, or an
alarm.
Drop—Drop the packets and generate a system log entry,
an SNMP trap, or an alarm (default).
Shutdown—Shut down the VLAN and generate an alarm.
You can mitigate the effect of this option by configuring
autorecovery from the disabled state and specifying a
value. See "Configuring Autorecovery
disable timeout
From the Disabled State on Secure or Storm Control
Interfaces (CLI Procedure)" on page 2796.
None—No action to be taken.
> . See Using the
Commit
Copyright © 2010, Juniper Networks, Inc.