TechLibrary

Port Security Overview
Port Security Overview Understanding DAI for Port Security Understanding DHCP Option 82 for Port Security on EX Series Switches Understanding DHCP Snooping for Port Security Understanding IP Source Guard for Port Security on EX Series Switches Understanding IPv6 Neighbor Discovery Inspection Understanding MAC Limiting and MAC Move Limiting for Port Security on EX Series Switches Understanding Media Access Control Security (MACsec) Understanding Persistent MAC Learning (Sticky MAC) Understanding Trusted DHCP Servers for Port Security

Port Security Overview

Understanding DAI for Port Security

Understanding DHCP Option 82 for Port Security on EX Series Switches

Understanding DHCP Snooping for Port Security

Understanding IP Source Guard for Port Security on EX Series Switches

Understanding IPv6 Neighbor Discovery Inspection

Understanding MAC Limiting and MAC Move Limiting for Port Security on EX Series Switches

Understanding Media Access Control Security (MACsec)

Understanding Persistent MAC Learning (Sticky MAC)

Understanding Trusted DHCP Servers for Port Security

Configuration Examples
Example: Configuring IP Source Guard and Dynamic ARP Inspection to Protect the Switch from IP Spoofing and ARP Spoofing Example: Configuring IPv6 Source Guard and Neighbor Discovery Inspection to Protect the Switch from IPv6 Address Spoofing

Configuration Examples

Example: Configuring IP Source Guard and Dynamic ARP Inspection to Protect the Switch from IP Spoofing and ARP Spoofing

Example: Configuring IPv6 Source Guard and Neighbor Discovery Inspection to Protect the Switch from IPv6 Address Spoofing

Configuration Tasks
Configuring Port Security (CLI Procedure) Configuring Port Security (J-Web Procedure) Configuring Autorecovery From the Disabled State on Secure or Storm Control Interfaces (CLI Procedure) Configuring IP Source Guard (CLI Procedure) Enabling IPv6 Neighbor Discovery Inspection Configuring Media Access Control Security (MACsec) Configuring MAC Limiting (CLI Procedure) Configuring MAC Limiting (J-Web Procedure) Configuring MAC Move Limiting (CLI Procedure) Configuring Persistent MAC Learning (CLI Procedure) Configuring Static IP Addresses for DHCP Bindings on Access Ports (CLI Procedure) Enabling Dynamic ARP Inspection (CLI Procedure) Enabling Dynamic ARP Inspection (J-Web Procedure) Enabling a Trusted DHCP Server (CLI Procedure) Enabling a Trusted DHCP Server (J-Web Procedure) Configuring Persistent Bindings in the DHCP or DHCPv6 Snooping Database (CLI Procedure) Setting Up DHCP Option 82 on the Switch with No Relay Agent Between Clients and DHCP Server (CLI Procedure) Enabling DHCPv6 Rapid Commit Support

Configuration Tasks

Configuring Port Security (CLI Procedure)

Configuring Port Security (J-Web Procedure)

Configuring Autorecovery From the Disabled State on Secure or Storm Control Interfaces (CLI Procedure)

Configuring IP Source Guard (CLI Procedure)

Enabling IPv6 Neighbor Discovery Inspection

Configuring Media Access Control Security (MACsec)

Configuring MAC Limiting (CLI Procedure)

Configuring MAC Limiting (J-Web Procedure)

Configuring MAC Move Limiting (CLI Procedure)

Configuring Persistent MAC Learning (CLI Procedure)

Configuring Static IP Addresses for DHCP Bindings on Access Ports (CLI Procedure)

Enabling Dynamic ARP Inspection (CLI Procedure)

Enabling Dynamic ARP Inspection (J-Web Procedure)

Enabling a Trusted DHCP Server (CLI Procedure)

Enabling a Trusted DHCP Server (J-Web Procedure)

Configuring Persistent Bindings in the DHCP or DHCPv6 Snooping Database (CLI Procedure)

Setting Up DHCP Option 82 on the Switch with No Relay Agent Between Clients and DHCP Server (CLI Procedure)

Enabling DHCPv6 Rapid Commit Support

Configuration Statements
[edit vlans] Configuration Statement Hierarchy on EX Series Switches arp-inspection cak circuit-id ckn connectivity-association connectivity-association (MACsec Interfaces) direction dhcp-security dhcp-service dhcp-snooping-file dhcpv6-snooping-file encryption exclude-protocol group host-name id interface interface-mac-limit interfaces (MACsec) ip-source-guard ipv6-source-guard key key-server-priority mac mac-address mac-move-limit macsec mka nd-inspection no-dhcpv6-snooping no-encryption no-option37 offset overrides packet-action persistent-learning port-id pre-shared-key recovery-timeout remote-id replay-protect replay-window-size routing-instance-name secure-channel security-association security-mode static-ip static-ipv6 traceoptions transmit-interval (MACsec) trusted untrusted use-interface-description use-string use-vlan-id vendor-id write-interval

Configuration Statements

[edit vlans] Configuration Statement Hierarchy on EX Series Switches

connectivity-association

connectivity-association (MACsec Interfaces)

routing-instance-name

transmit-interval (MACsec)

trusted

untrusted

use-interface-description

Operational Commands
clear arp clear dhcp-security binding clear dhcp-security ipv6 binding clear dot1x clear ethernet-switching recovery-timeout clear security mka statistics show dhcp-security arp inspection statistics show dhcp-security binding show dhcp-security binding ip-source-guard show dhcp-security ipv6 binding show dhcp-security ipv6 statistics show dhcp-security nd-inspection statistics show security macsec connections show security macsec statistics show security mka sessions show security mka statistics

Operational Commands

clear arp

clear dhcp-security binding

clear dhcp-security ipv6 binding

clear dot1x

clear ethernet-switching recovery-timeout

clear security mka statistics

show dhcp-security arp inspection statistics

show dhcp-security binding

show dhcp-security binding ip-source-guard

show dhcp-security ipv6 binding

show dhcp-security ipv6 statistics