- play_arrow Port Security
- play_arrow Port Security Overview
-
- play_arrow IPSec
- play_arrow Understanding IPsec and Security Associations
- play_arrow IPsec Configurations and Examples
- play_arrow Configuring IPsec Security Associations
- play_arrow Using Digital Certificates for IPsec
- play_arrow Additional IPsec Options
- play_arrow Configuring IPsec Dynamic Endpoints
- play_arrow Additional ES and AS PIC Configuration Examples
- Example: ES PIC Manual SA Configuration
- Example: AS PIC Manual SA Configuration
- Example: ES PIC IKE Dynamic SA Configuration
- Example: AS PIC IKE Dynamic SA Configuration
- Example: IKE Dynamic SA Between an AS PIC and an ES PIC Configuration
- Example: AS PIC IKE Dynamic SA with Digital Certificates Configuration
- Example: Dynamic Endpoint Tunneling Configuration
-
- play_arrow Digital Certificates
- play_arrow Configuring Digital Certificates
- Public Key Cryptography
- Configuring Digital Certificates
- Configuring Digital Certificates for an ES PIC
- IKE Policy for Digital Certificates on an ES PIC
- Configuring Digital Certificates for Adaptive Services Interfaces
- Configuring Auto-Reenrollment of a Router Certificate
- IPsec Tunnel Traffic Configuration
- Tracing Operations for Security Services
- play_arrow Configuring SSH and SSL Router Access
-
- play_arrow Trusted Platform Module
- play_arrow MACsec
- play_arrow Understanding MACsec
- play_arrow MACsec Examples
-
- play_arrow MAC Limiting and Move Limiting
- play_arrow MAC Limiting and Move Limiting Configurations and Examples
- Understanding MAC Limiting and MAC Move Limiting
- Understanding MAC Limiting on Layer 3 Routing Interfaces
- Understanding and Using Persistent MAC Learning
- Configuring MAC Limiting
- Example: Configuring MAC Limiting
- Verifying That MAC Limiting Is Working Correctly
- Override a MAC Limit Applied to All Interfaces
- Configuring MAC Move Limiting (ELS)
- Verifying That MAC Move Limiting Is Working Correctly
- Verifying That the Port Error Disable Setting Is Working Correctly
-
- play_arrow IP Source Guard
- play_arrow Understanding IP Source Guard
- play_arrow IP Source Guard Examples
- Example: Configuring IP Source Guard on a Data VLAN That Shares an Interface with a Voice VLAN
- Example: Configuring IP Source Guard with Other EX Series Switch Features to Mitigate Address-Spoofing Attacks on Untrusted Access Interfaces
- Example: Configuring IP Source Guard and Dynamic ARP Inspection to Protect the Switch from IP Spoofing and ARP Spoofing
- Example: Configuring IPv6 Source Guard and Neighbor Discovery Inspection to Protect a Switch from IPv6 Address Spoofing
- Configuring IP Source Guard to Mitigate the Effects of Source IP Address Spoofing and Source MAC Address Spoofing
- Example: Configuring IP Source Guard and Dynamic ARP Inspection on a Specified Bridge Domain to Protect the Devices Against Attacks
- Example: Configuring IPv6 Source Guard and Neighbor Discovery Inspection to Protect a Switch from IPv6 Address Spoofing
-
- play_arrow IPv6 Access Security
- play_arrow Neighbor Discovery Protocol
- play_arrow SLAAC Snooping
- play_arrow Router Advertisement Guard
-
- play_arrow Control Plane Distributed Denial-of-Service (DDoS) Protection and Flow Detection
- play_arrow Control Plane DDoS Protection
- play_arrow Flow Detection and Culprit Flows
-
- play_arrow Unicast Forwarding
- play_arrow Unicast Reverse Path Forwarding
- play_arrow Unknown Unicast Forwarding
-
- play_arrow Storm Control
- play_arrow Malware Protection
- play_arrow Juniper Malware Removal Tool
-
- play_arrow Configuration Statements and Operational Commands
Configuring Persistent Bindings in the DHCP or DHCPv6 (ELS)
This task uses Junos OS with support for the Enhanced Layer 2 Software (ELS) configuration style.If your switch runs software that does not support ELS, see Configuring Persistent Bindings in the DHCP or DHCPv6 (non-ELS). For ELS details, see Using the Enhanced Layer 2 Software CLI.
By default, IP-MAC address bindings in the DHCP snooping database do not persist through device reboots. You can improve network performance by configuring the IP-MAC address bindings in the DHCP snooping database to persist through reboots so that the table does not need to be rebuilt after rebooting. Do this by configuring a storage location for the DHCP snooping database file, where you must specify how frequently the device writes the database entries into the DHCP snooping database file.
You can also configure persistent bindings for IPv6 addresses and MAC addresses on devices that support DHCPv6 snooping.
DHCPv6 is not supported on the MX Series routers.
The DHCP snooping database of IP-MAC bindings is created when you enable any of the port security features for a specific VLAN or bridge domain in either of the following hierarchy levels:
[edit vlans vlan-name forwarding-options dhcp-security][edit bridge-domains bridge-domain-name forwarding-options dhcp-security]
On devices that support DHCPv6, enabling any port security features will automatically enable DHCPv6 snooping. DHCP snooping and DHCPv6 snooping are not enabled by default.
By default, the IP-MAC bindings are lost when the
switch is rebooted, and the DHCP clients (the
network devices, or hosts) must reacquire
bindings. However, you can configure the bindings
to persist by setting the
dhcp-snooping-file statement to
store the database file either locally or
remotely. When you configure and enable 802.1x
dynamic VLAN, the DHCP snooping entries also get
deleted. Due to this, it is recommended to
configure for a DHCP server to store lease
information for clients and provide them with a
predictable IP address even after you reboot the
client (DHCP persistence).
To configure a local storage location for the DHCP snooping database file:
For DHCP snooping:
content_copy zoom_out_map[edit system processes] user@device# set dhcp-service dhcp-snooping-file local-pathname write-interval seconds
For example:
content_copy zoom_out_map[edit system processes] user@device# set dhcp-service dhcp-snooping-file /var/tmp/test.log write-interval 60
For DHCPv6 snooping:
content_copy zoom_out_map[edit system processes] user@device# set dhcp-service dhcpv6-snooping-file local-pathname write-interval seconds
For example:
content_copy zoom_out_map[edit system processes] user@device# set dhcp-service dhcpv6-snooping-file /var/tmp/test.log write-interval 60
To configure a remote storage location for IP-MAC bindings,
use tftp://ip-addressor ftp://hostname/path as the remote URL, or the local pathname for the storage
location of the DHCP or DHCPv6 snooping database file:
For DHCP snooping:
content_copy zoom_out_map[edit system processes] user@device# set dhcp-service dhcp-snooping-file remote_url write-interval seconds
For example:
content_copy zoom_out_map[edit system processes] user@device# set dhcp-service dhcp-snooping-file tftp://@14.1.2.1 write-interval 60
For DHCPv6 snooping:
content_copy zoom_out_map[edit system processes] user@device# set dhcp-service dhcpv6-snooping-file remote_url write-interval seconds
For example:
content_copy zoom_out_map[edit system processes] user@device# set dhcp-service dhcpv6-snooping-file tftp://@14.1.2.1 write-interval 60
.
