TechLibrary

Port Security Overview
Port Security Overview Understanding How to Protect Access Ports on EX Series Switches from Common Attacks Understanding DHCP Snooping for Port Security Understanding DAI for Port Security Understanding MAC Limiting and MAC Move Limiting for Port Security on EX Series Switches Understanding Media Access Control Security (MACsec) Understanding Trusted DHCP Servers for Port Security Understanding IP Source Guard for Port Security on EX Series Switches Understanding DHCP Option 82 for Port Security on EX Series Switches Understanding Persistent MAC Learning (Sticky MAC)

Port Security Overview

Understanding How to Protect Access Ports on EX Series Switches from Common Attacks

Understanding DHCP Snooping for Port Security

Understanding DAI for Port Security

Understanding MAC Limiting and MAC Move Limiting for Port Security on EX Series Switches

Understanding Media Access Control Security (MACsec)

Understanding Trusted DHCP Servers for Port Security

Understanding IP Source Guard for Port Security on EX Series Switches

Understanding DHCP Option 82 for Port Security on EX Series Switches

Understanding Persistent MAC Learning (Sticky MAC)

Configuration Examples
Example: Configuring Basic Port Security Features Example: Configuring MAC Limiting, Including Dynamic and Allowed MAC Addresses, to Protect the Switch from Ethernet Switching Table Overflow Attacks Example: Configuring a DHCP Server Interface as Untrusted to Protect the Switch from Rogue DHCP Server Attacks Example: Configuring MAC Limiting to Protect the Switch from DHCP Starvation Attacks Example: Configuring DHCP Snooping and DAI to Protect the Switch from ARP Spoofing Attacks Example: Configuring Allowed MAC Addresses to Protect the Switch from DHCP Snooping Database Alteration Attacks Example: Configuring DHCP Snooping, DAI , and MAC Limiting on a Switch with Access to a DHCP Server Through a Second Switch Example: Configuring IP Source Guard with Other EX Series Switch Features to Mitigate Address-Spoofing Attacks on Untrusted Access Interfaces Example: Configuring IP Source Guard on a Data VLAN That Shares an Interface with a Voice VLAN Example: Setting Up DHCP Option 82 with a Switch as a Relay Agent Between Clients and a DHCP Server Example: Setting Up DHCP Option 82 with a Switch with No Relay Agent Between Clients and a DHCP Server Example: Using CoS Forwarding Classes to Prioritize Snooped Packets in Heavy Network Traffic

Configuration Examples

Example: Configuring Basic Port Security Features

Example: Configuring MAC Limiting, Including Dynamic and Allowed MAC Addresses, to Protect the Switch from Ethernet Switching Table Overflow Attacks

Example: Configuring a DHCP Server Interface as Untrusted to Protect the Switch from Rogue DHCP Server Attacks

Example: Configuring MAC Limiting to Protect the Switch from DHCP Starvation Attacks

Example: Configuring DHCP Snooping and DAI to Protect the Switch from ARP Spoofing Attacks

Example: Configuring Allowed MAC Addresses to Protect the Switch from DHCP Snooping Database Alteration Attacks

Example: Configuring DHCP Snooping, DAI , and MAC Limiting on a Switch with Access to a DHCP Server Through a Second Switch

Example: Configuring IP Source Guard with Other EX Series Switch Features to Mitigate Address-Spoofing Attacks on Untrusted Access Interfaces

Example: Configuring IP Source Guard on a Data VLAN That Shares an Interface with a Voice VLAN

Example: Setting Up DHCP Option 82 with a Switch as a Relay Agent Between Clients and a DHCP Server

Example: Setting Up DHCP Option 82 with a Switch with No Relay Agent Between Clients and a DHCP Server

Example: Using CoS Forwarding Classes to Prioritize Snooped Packets in Heavy Network Traffic

Configuration Tasks
Configuring Port Security (CLI Procedure) Configuring Port Security (J-Web Procedure) Configuring Media Access Control Security (MACsec) Enabling DHCP Snooping (CLI Procedure) Enabling DHCP Snooping (J-Web Procedure) Enabling a Trusted DHCP Server (CLI Procedure) Enabling a Trusted DHCP Server (J-Web Procedure) Enabling Dynamic ARP Inspection (CLI Procedure) Enabling Dynamic ARP Inspection (J-Web Procedure) Configuring MAC Limiting (CLI Procedure) Configuring MAC Limiting (J-Web Procedure) Configuring MAC Move Limiting (CLI Procedure) Configuring MAC Move Limiting (J-Web Procedure) Setting the none Action on an Interface to Override a MAC Limit Applied to All Interfaces (CLI Procedure) Configuring IP Source Guard (CLI Procedure) Configuring Static IP Addresses for DHCP Bindings on Access Ports (CLI Procedure) Setting Up DHCP Option 82 with the Switch as a Relay Agent Between Clients and DHCP Server (CLI Procedure) Setting Up DHCP Option 82 on the Switch with No Relay Agent Between Clients and DHCP Server (CLI Procedure) Configuring Autorecovery From the Disabled State on Secure or Storm Control Interfaces (CLI Procedure) Configuring Persistent MAC Learning (CLI Procedure) Making IP-MAC Bindings in the DHCP Snooping Database Persistent (CLI Procedure)

Configuration Tasks

Configuring Port Security (CLI Procedure)

Configuring Port Security (J-Web Procedure)

Configuring Media Access Control Security (MACsec)

Enabling DHCP Snooping (CLI Procedure)

Enabling DHCP Snooping (J-Web Procedure)

Enabling a Trusted DHCP Server (CLI Procedure)

Enabling a Trusted DHCP Server (J-Web Procedure)

Enabling Dynamic ARP Inspection (CLI Procedure)

Enabling Dynamic ARP Inspection (J-Web Procedure)

Configuring MAC Limiting (CLI Procedure)

Configuring MAC Limiting (J-Web Procedure)

Configuring MAC Move Limiting (CLI Procedure)

Configuring MAC Move Limiting (J-Web Procedure)

Setting the none Action on an Interface to Override a MAC Limit Applied to All Interfaces (CLI Procedure)

Configuring IP Source Guard (CLI Procedure)

Configuring Static IP Addresses for DHCP Bindings on Access Ports (CLI Procedure)

Setting Up DHCP Option 82 with the Switch as a Relay Agent Between Clients and DHCP Server (CLI Procedure)

Setting Up DHCP Option 82 on the Switch with No Relay Agent Between Clients and DHCP Server (CLI Procedure)

Configuring Autorecovery From the Disabled State on Secure or Storm Control Interfaces (CLI Procedure)

Configuring Persistent MAC Learning (CLI Procedure)

Making IP-MAC Bindings in the DHCP Snooping Database Persistent (CLI Procedure)

Configuration Statements
[edit ethernet-switching-options] Configuration Statement Hierarchy on EX Series Switches [edit forwarding-options] Configuration Statement Hierarchy on EX Series Switches [edit security] Configuration Statement Hierarchy on EX Series Switches allowed-mac arp-inspection cak circuit-id ckn connectivity-association connectivity-association (MACsec Interfaces) direction dhcp-option82 dhcp-snooping-file dhcp-trusted disable-timeout encryption ethernet-switching-options examine-dhcp exclude-protocol forwarding-class id include-sci interface (Access Port Security) interfaces (MACsec) ip-source-guard key key-server-priority location (DHCP Snooping Database) mac mac-address mac-limit (Access Port Security) mac-move-limit macsec mka no-allowed-mac-log no-gratuitous-arp-request no-encryption offset persistent-learning port-error-disable port-id pre-shared-key prefix (Circuit ID for Option 82) prefix (Remote ID for Option 82) remote-id replay-protect replay-window-size secure-access-port secure-channel security-association security-mode static-ip timeout traceoptions (Access Port Security) transmit-interval (MACsec) use-interface-description use-string use-vlan-id vendor-id vlan (Access Port Security) vlan (DHCP Bindings on Access Ports) write-interval

Configuration Statements

[edit ethernet-switching-options] Configuration Statement Hierarchy on EX Series Switches

[edit forwarding-options] Configuration Statement Hierarchy on EX Series Switches

[edit security] Configuration Statement Hierarchy on EX Series Switches

connectivity-association

connectivity-association (MACsec Interfaces)

ethernet-switching-options

interface (Access Port Security)

location (DHCP Snooping Database)

mac

mac-address

mac-limit (Access Port Security)

no-gratuitous-arp-request

prefix (Circuit ID for Option 82)

prefix (Remote ID for Option 82)

traceoptions (Access Port Security)

transmit-interval (MACsec)

use-interface-description

use-string

use-vlan-id

vendor-id

vlan (Access Port Security)

vlan (DHCP Bindings on Access Ports)

write-interval

Routine Monitoring
Monitoring Port Security Verifying That DHCP Snooping Is Working Correctly Verifying That a Trusted DHCP Server Is Working Correctly Verifying That DAI Is Working Correctly Verifying That MAC Limiting Is Working Correctly Verifying That MAC Move Limiting Is Working Correctly Verifying That IP Source Guard Is Working Correctly Verifying That the Port Error Disable Setting Is Working Correctly Verifying That Persistent MAC Learning Is Working Correctly

Routine Monitoring

Monitoring Port Security

Verifying That DHCP Snooping Is Working Correctly

Verifying That a Trusted DHCP Server Is Working Correctly

Verifying That DAI Is Working Correctly

Verifying That MAC Limiting Is Working Correctly

Verifying That MAC Move Limiting Is Working Correctly

Verifying That IP Source Guard Is Working Correctly

Verifying That the Port Error Disable Setting Is Working Correctly

Verifying That Persistent MAC Learning Is Working Correctly

Operational Commands
clear arp inspection statistics clear dhcp snooping binding clear dhcp snooping statistics clear dot1x clear security mka statistics show arp inspection statistics show dhcp snooping binding show dhcp snooping statistics show ethernet-switching table show ip-source-guard show security macsec connections show security macsec statistics show security mka sessions show security mka statistics show system statistics arp

Operational Commands

clear arp inspection statistics

clear dhcp snooping binding

clear dhcp snooping statistics

clear dot1x

clear security mka statistics

show arp inspection statistics

show dhcp snooping binding

show dhcp snooping statistics

show ethernet-switching table

show ip-source-guard

show security macsec connections