Juniper JUNOS OS 10.4 - FOR EX REV 1 Manual page 3180

Complete Software Guide for Junos
Configuration
CLI Quick
Configuration
Step-by-Step
Procedure
3076
®
OS for EX Series Ethernet Switches, Release 10.4
you modify the value for MAC limit; and you configure some specific (allowed) MAC
addresses on an interface.
To configure basic port security on a switch whose DHCP server and client ports are in a
single VLAN:
To quickly configure basic port security on the switch, copy the following commands and
paste them into the switch terminal window:
[edit ethernet-switching-options secure-access-port]
set interface ge-0/0/1 mac-limit 4
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:80
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:81
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:83
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:85
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:88
set interface ge-0/0/2 mac-limit 4
set interface ge-0/0/8 dhcp-trusted
set vlan employee–vlan arp-inspection
set vlan employee-vlan examine-dhcp
set vlan employee-vlan mac-move-limit 5
Configure basic port security on the switch:
Enable DHCP snooping on the VLAN:
1.
[edit ethernet-switching-options secure-access-port]
user@switch# set vlan employee-vlan examine-dhcp
Specify the interface (port) from which DHCP responses are allowed:
2.
[edit ethernet-switching-options secure-access-port]
user@switch# set interface ge-0/0/8 dhcp-trusted
Enable dynamic ARP inspection (DAI) on the VLAN:
3.
[edit ethernet-switching-options secure-access-port]
user@switch# set vlan employee-vlan arp-inspection
Configure the MAC limit of
4.
dropped and the MAC address will not be added to the Ethernet switching table if
the MAC limit has been exceeded on the interfaces):
[edit ethernet-switching-options secure-access-port]
user@switch# set interface ge-0/0/1 mac-limit 4
user@switch# set interface ge-0/0/2 mac-limit 4
Configure a MAC move limit of
5.
dropped and the MAC address will not be added to the Ethernet switching table if
a MAC address has exceeded the MAC move limit):
[edit ethernet-switching-options secure-access-port]
user@switch# set vlan employee-vlan mac-move-limit 5
Configure the allowed MAC addresses:
6.
[edit ethernet-switching-options secure-access-port]
user@switch# set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:80
user@switch# set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:81
and use the default action,
4
and use the default action,
5
Copyright © 2010, Juniper Networks, Inc.
. (Packets will be
drop
. (Packets will be
drop