HP ProCurve 3500yl Release Notes page 145

• Remove the trusted-port configuration.
You can configure dynamic IP lockdown only from the CLI; this feature cannot be configured
■
from the Web management or menu interface.
■ If you enable dynamic IP lockdown on a port, you cannot add the port to a trunk.
■ Dynamic IP lockdown must be removed from a trunk before the trunk is removed.
Adding an IP-to-MAC Binding to the DHCP Binding Database
A switch maintains a DHCP binding database, which is used for dynamic IP lockdown as well as for
DHCP and ARP packet validation. The DHCP snooping feature maintains the lease database by
learning the IP-to-MAC bindings of VLAN traffic on untrusted ports. Each binding consists of the
client MAC address, port number, VLAN identifier, leased IP address, and lease time.
Dynamic IP lockdown supports a total of 4K static and dynamic bindings with up to 64 bindings per
port. When DHCP snooping is enabled globally on a VLAN, dynamic bindings are learned when a
client on the VLAN obtains an IP address from a DHCP server. Static bindings are created manually
with the CLI or from a downloaded configuration file.
When dynamic IP lockdown is enabled globally or on ports the bindings associated with the ports
are written to hardware. This occurs during these events:
• Switch initialization
• Hot swap
• A dynamic IP lockdown-enabled port is moved to a DHCP snooping-enabled VLAN
• DHCP snooping or dynamic IP lockdown characteristics are changed such that dynamic
IP lockdown is enabled on the ports
Potential Issues with Bindings
• When dynamic IP lockdown enabled, and a port or switch has the maximum number of
bindings configured, the client DHCP request will be dropped and the client will not
receive an IP address through DHCP.
• When dynamic IP lockdown is enabled and a port is configured with the maximum
number of bindings, adding a static binding to the port will fail.
• When dynamic IP lockdown is enabled globally, the bindings for each port are written
to hardware. If global dynamic IP lockdown is enabled and disabled several times, it is
possible to run out of buffer space for additional bindings. The software will delay adding
the bindings to hardware until resources are available.
Enhancements
Release K.13.19 Enhancements
134