HP ProCurve Series 3400cl Release Notes page 141

• Remove the trusted-port configuration.
You can configure dynamic IP lockdown only from the CLI; this feature cannot be configured
■
from the Web management or menu interface.
■ If you enable dynamic IP lockdown on a port, you cannot add the port to a trunk.
■ Dynamic IP lockdown must be removed from a trunk before the trunk is removed.
Adding an IP-to-MAC Binding to the DHCP Binding Database
A switch maintains a DHCP binding database, which is used for dynamic IP lockdown as well as for
DHCP and ARP packet validation. The DHCP snooping feature maintains the lease database by
learning the IP-to-MAC bindings of VLAN traffic on untrusted ports. Each binding consists of the
client MAC address, port number, VLAN identifier, leased IP address, and lease time.
Dynamic IP lockdown supports a total of 4K static and dynamic bindings with up to 64 bindings per
port. When DHCP snooping is enabled globally on a VLAN, dynamic bindings are learned when a
client on the VLAN obtains an IP address from a DHCP server. Static bindings are created manually
with the CLI or from a downloaded configuration file.
When dynamic IP lockdown is enabled globally or on ports the bindings associated with the ports
are written to hardware. This occurs during these events:
Switch initialization
■
Hot swap
■
■ A dynamic IP lockdown-enabled port is moved to a DHCP snooping-enabled VLAN
DHCP snooping or dynamic IP lockdown characteristics are changed such that dynamic IP
■
lockdown is enabled on the ports
Potential Issues with Bindings
■ When dynamic IP lockdown enabled, and a port or switch has the maximum number of
bindings configured, the client DHCP request will be dropped and the client will not receive
an IP address through DHCP.
■ When dynamic IP lockdown is enabled and a port is configured with the maximum number
of bindings, adding a static binding to the port will fail.
■ When dynamic IP lockdown is enabled globally, the bindings for each port are written to
hardware. If global dynamic IP lockdown is enabled and disabled several times, it is possible
to run out of buffer space for additional bindings. The software will delay adding the bindings
to hardware until resources are available.
Enhancements
Release M.10.43 Enhancements
131