Table 409: Port Security Settings On Vlans - Juniper JUNOS OS 10.4 - FOR EX REV 1 Manual

Complete Software Guide for Junos

Table 409: Port Security Settings on VLANs

Field Function
Enable DHCP Allows the switch to monitor and control
Snooping on DHCP messages received from untrusted
VLAN devices connected to the switch. Builds and
maintains a database of valid IP
addresses/MAC address bindings. (By
default, access ports are untrusted and trunk
ports are trusted.)
Enable ARP Uses information in the DHCP snooping
Inspection on database to validate ARP packets on the
VLAN LAN and protect against ARP cache
poisoning.
MAC Movement Specifies the number of times per second
that a MAC address can move to a new
interface.
MAC Movement Specifies the action to be taken if the MAC
Action move limit is exceeded.
3132
®
OS for EX Series Ethernet Switches, Release 10.4
NOTE: After you make changes to the configuration in this page, you must
commit the changes for them to take effect. To commit all changes to
the active configuration, select
Commit Options to Commit Configuration Changes for details about all
commit options.
Click one:
2.
Edit —Click this option to modify the security features for the selected port or VLAN.
Enter information as specified in Table 409 on page 3132 to modify Port Security
settings on VLANs.
Enter information as specified in Table 410 on page 3133 to modify Port Security
settings on interfaces.
Activate/Deactivate —Click this option to enable or disable security on the switch.
Commit Options
Your Action
Select to enable DHCP snooping on a specified VLAN or all
VLANs.
TIP: For private VLANs (PVLANs), enable DHCP snooping
on the primary VLAN. If you enable DHCP snooping only on
a community VLAN, DHCP messages coming from PVLAN
trunk ports are not snooped.
Select to enable ARP inspection on a specified VLAN or all
VLANs. (Configure any port on which you do not want ARP
inspection to occur as a trusted DHCP server port.)
Enter a number. The default is unlimited.
Select one:
Log—Generate a system log entry, an SNMP trap, or an
alarm.
Drop—Drop the packets and generate a system log entry,
an SNMP trap, or an alarm (default).
Shutdown—Shut down the VLAN and generate an alarm.
You can mitigate the effect of this option by configuring
autorecovery from the disabled state and specifying a
disable timeout value. See "Configuring Autorecovery From
the Disabled State on Secure or Storm Control Interfaces
(CLI Procedure)" on page 3018.
None—No action to be taken.
Copyright © 2010, Juniper Networks, Inc.
> . See Using the
Commit