Icmp message configurations | Brocade Communications Systems 6650

Creating an IPv6 ACL

TABLE 18 Syntax descriptions (Continued)

IPv6 ACL arguments	Description

802.1p-priority-matching number	Enables the device to match only those packets that have the same 802.1p
	priorities as specified in the ACL. Enter 0 – 7.
	Use this option in conjunction with traffic policies to rate limit traffic for a
	specified 802.1p priority value. For details, refer to “Inspecting the 802.1p
	bit in the ACL for adaptive rate limiting” on page 146.

dscp-marking number	Use the dscp-markingnumber parameter to specify a new QoS value to the
	packet. If a packet matches the filters in the ACL statement, this parameter
	assigns the DSCP value that you specify to the packet. Enter 0 – 63.

802.1p-priority-marking number	Use the 802.1p-priority-markingnumber parameter to specify a new QoS
	value to the packet (0-7). If a packet matches the filters in the ACL
	statement, it assigns the priority that you specify to the 802.1p priority and
	the internal priority.

internal-priority-marking number	Use the internal-priority-markingnumber parameter to specify a new QoS
	value to the packet (0-7). If a packet matches the filters in the ACL
	statement, it assigns the priority that you specify to the internal priority and
	the 802.1p priority.
	NOTE: Configuring 802.1p-priority-markingalone or configuring both
	802.1p-priority-marking and internal-priority-marking has the same
	functionality. That is, it assigns the priority that you specify to the
	802.1p priority and the internal priority.

ICMP message configurations

If you want to specify an ICMP message, you can enter one of the following ICMP message types:

•beyond-scope

•destination-unreachable

•echo-reply

•echo-request

•header

•hop-limit

•mld-query

•mld-reduction

•mld-report

•nd-na

•nd-ns

•next-header

•no-admin

•no-route

•packet-too-big

•parameter-option

•parameter-problem

•port-unreachable

•reassembly-timeout

136	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01

Image 156

Brocade Communications Systems 6650 manual Icmp message configurations, 802.1p-priority-matching number

Contents

Brocade ICX Brocade Communications Systems, Incorporated Contents Brocade ICX 6650 Security Configuration Guide Chapter Brocade ICX 6650 Security Configuration Guide ACL-based rate limiting overview Types of ACL-based rate limiting Chapter 802.1X Port Security Ietf RFC support MAC-based Vlan feature structure MAC port security overviewLocal and global resources used for MAC port security MAC-based Vlan overview How multi-device port authentication works Radius authenticationAuthentication-failure actions Supported Radius attributes Smurf attacks Avoiding being an intermediary in a Smurf attackAvoiding being a victim in a Smurf attack Configuration notes for port-based fixed rate limiting Configuring a port-based fixed rate limiting policyDisplaying the port-based fixed rate limiting configuration Configuration notes and feature limitations for DAI Configuration notes and feature limitations Configuring rate limiting for BUM trafficBroadcast, unknown Unicast, and Multicast rate limiting Viewing rate limits set on BUM trafficPage Audience Supported hardware and softwareBrocade ICX 6650 slot and port numbering How this document is organized Dhcp on Command syntax conventions Document conventionsText formatting Related publications Corporation Referenced Trademarks and Products Additional information Getting technical helpBrocade resources Other industry resources Document feedback Securing access methods Feature Brocade ICX Method is secured Remote access to management function restrictions ACL usage to restrict remote access Using an ACL to restrict Telnet access Using an ACL to restrict SSH accessSyntax telnet access-group num Syntax ssh access-group num Using ACLs to restrict Snmp access Defining the console idle timeSyntax snmp-server community string ro rw num Remote access restrictions Restricting Telnet access to a specific IP addressRestricting SSH access to a specific IP address Restricting access to the device based on IP or MAC address Restricting Snmp access to a specific IP addressRestricting Telnet connection Restricting SSH connection Changing the login timeout period for Telnet sessions Defining the Telnet idle timeRestricting Http and Https connection Restricting Telnet access to a specific Vlan Syntax no telnet login-retries number Restricting Snmp access to a specific Vlan Restricting Tftp access to a specific VlanSyntax no telnet server enable vlan vlan-id Syntax no snmp-server enable vlan vlan-id Allowing SSHv2 access to the Brocade device Syntax no default-gateway ip-addr metricDevice management security Syntax crypto key generate zeroize Disabling specific access methods Allowing Snmp access to the Brocade deviceDisabling Telnet access Disabling Snmp access Passwords used to secure access Setting a Telnet passwordSyntax no tftp disable Syntax no enable telnet password string Setting passwords for management privilege levels Passwords used to secure accessSyntax no telnet server suppress-reject-message Syntax enable read-only-password text Augmenting management privilege levels Recovering from a lost password Specifying a minimum password lengthEnter boot system flash primary at the prompt After the console prompt reappears, assign a new password Enhancements to username and password Syntax enable password-min-length number-of-charactersLocal user accounts Number-of-characterscan be from Enabling enhanced user password combination requirements Syntax no enable strict-password-enforcement Enabling user password masking Enabling user password agingSyntax username name password Enter Syntax no enable user password-masking Configuring password history Enhanced login lockoutSyntax no enable user password-aging Syntax no enable user password-history 1 Local user account configuration Setting passwords to expireSyntax username name enable Requirement to accept the message of the day Local user accounts with no passwords Local user accounts with unencrypted passwords Creating a password option Local accounts with encrypted passwordsUsing the username user-stringcreate-password command Syntax show users Changing a local user password Syntax no username user-stringpassword password-stringTacacs and TACACS+ security How TACACS+ differs from Tacacs TACACS/TACACS+ authentication, authorization, and accounting Kill console Syntax kill console all unit Tacacs authentication TACACS+ authentication TACACS+ authorization TACACS+ accounting AAA security for commands pasted into the running-config AAA operations for TACACS/TACACS+User action Applicable AAA operations TACACS/TACACS+ configuration considerations Configuring TacacsConfiguring TACACS+ Enabling Tacacs Identifying the TACACS/TACACS+ servers Setting optional Tacacs and TACACS+ parameters Specifying different servers for individual AAA functions Setting the TACACS+ key Setting the retransmission limitSetting the timeout parameter Method parameter Description Entering privileged Exec mode after a Telnet or SSH login Syntax aaa authentication login privilege-modeSyntax no aaa authentication enable implicit-user Configuring TACACS+ authorization Configuring Exec authorizationSyntax aaa authorization exec default tacacs+ none Configuring an Attribute-Value pair on the TACACS+ server Foundry-privlvl = Configuring command authorization AAA support for console commands TACACS+ accounting configuration Configuring TACACS+ accounting for Telnet/SSH Shell accessConfiguring TACACS+ accounting for CLI commands Syntax no enable aaa console Configuring TACACS+ accounting for system events Radius authentication, authorization, and accounting Radius authenticationOutput of the show aaa command for TACACS/TACACS+ Radius security Radius authorization Radius accounting AAA operations for Radius AAA operations for Radius Radius configuration considerations Radius security AAA operations for Radius Configuring Radius Brocade-specific attributes on the Radius server Port Configuration level Allows Attribute ID Data type Description Enabling Snmp to configure Radius Identifying the Radius server to the Brocade deviceAttribute name Attribute ID Data type Description Radius server per port configuration notes Radius configuration example and command syntaxFollowing shows an example configuration Radius server per port Radius server-to-ports configuration notes Radius server to individual ports mappingSyntax use-radius-server ip-addr Host ip-addris an IPv4 address Setting the Radius key Radius parametersSyntax radius-server key 0 1 string Syntax radius-server retransmit number Setting authentication-method lists for Radius Setting Radius over IPv6Syntax radius-server timeout number Syntax radius-server host ipv6 ipv6-host address Setting passwords for management privilege levels on Radius authorization Syntax aaa authorization exec default radius none Command authorization and accounting for console commands Configuring Radius accounting for Telnet/SSH Shell access Configuring Radius accounting for CLI commandsRadius accounting Displaying Radius configuration information Configuring Radius accounting for system events Output of the show aaa command for Radius Authentication-method lists Examples of authentication-method listsAuthentication-method lists Command Syntax Following is the command syntax for the preceding examplesExample User account configuration on TCP Flags edge port security Using TCP Flags in combination with other ACL features TCP Flags edge port security TCP Flags edge port security SSH2 and SCP SSH version 2 overview SSH2 supported features SSH2 unsupported featuresTested SSH2 clients Key exchange methods are diffie-hellman-group1-sha1 SSH2 authentication types Configuring SSH2SSH2 authentication types Configure DSA or RSA challenge-response authentication Setting the CPU priority for key generation Generating and deleting a DSA key pairGenerating and deleting an RSA key pair Configuring DSA or RSA challenge-response authentication Deleting DSA and RSA key pairsProviding the public key to clients Syntax crypto key zeroize Importing authorized public keys into the Brocade device Begin SSH2 Public KEY Enabling DSA or RSA challenge-response authentication Syntax ip ssh key-authentication yes noOptional SSH parameters Syntax clear public-key Setting the number of SSH authentication retries Deactivating user authenticationSyntax ip ssh authentication-retries number Syntax ip ssh password-authentication no yes Enabling empty password logins Setting the SSH port numberSetting the SSH login timeout value Configuring the maximum idle time for SSH sessions Filtering SSH access using ACLs Terminating an active SSH connectionDisplaying SSH information Displaying SSH connection information Displaying SSH configuration information Syntax show ip ssh configDisplaying SSH information SSH connection information Displaying SSH information SSH configuration information Displaying additional SSH connection information Secure copy configuration notes Example file transfers using SCPCopying a file to the running configuration Secure copy with SSH2 Copying a file to the startup configuration To overwrite the running configuration fileCopying a software image file to flash memory Copying a software image file from flash memory Importing a digital certificate using SCP Importing an RSA private keyImporting a DSA or RSA public key Configuring SSH2 client public key authentication SSH2 clientEnabling SSH2 client Using SSH2 client Generating and deleting a client DSA key pairGenerating and deleting a client RSA key pair Exporting client public keys Displaying SSH2 client information Supported ACL features on outbound traffic Rule-Based IP ACLs ACL overview Supported ACL features on outbound traffic ACL overview Types of IP ACLs ACL IDs and entriesNumbered and named ACLs ACL overview Virtual routing interfaces Default ACL action How hardware-based ACLs workHow fragmented packets are processed Hardware aging of Layer 4 CAM entries ACL configuration considerations Configuring standard numbered ACLs Standard numbered ACL syntax Standard named ACL configuration Configuration example for standard numbered ACLs Syntax no ip access-list standard ACL-nameACL-num Standard named ACL syntax Brocade ICX 6650 Security Configuration Guide 53-1002601-01 Extended numbered ACL configuration Configuration example for standard named ACLsExtended numbered ACL configuration Extended numbered ACL syntax Num Brocade ICX 6650 Security Configuration Guide 53-1002601-01 Brocade ICX 6650 Security Configuration Guide Configuration examples for extended numbered ACLs Here is another example of an extended ACL Extended named ACL configuration Extended named ACL configuration Extended named ACL syntax Num Brocade ICX 6650 Security Configuration Guide 53-1002601-01 Page Syntax enable egress-acl-on-cpu-traffic Applying egress ACLs to Control CPU trafficPreserving user input for ACL TCP/UDP port numbers Syntax ip preserve-ACL-user-input-format ACL comment text management Adding a comment to an entry in a numbered ACL Show running-config Show access-list Show ip access-list Adding a comment to an entry in a named ACLDeleting a comment from an ACL entry Viewing comments in an ACL Syntax show running-config Configuration notes for ACL logging ACL loggingACL logging Configuration tasks for ACL logging Example ACL logging configuration Syntax logging-enable Displaying ACL Log EntriesSyntax ACL-logging Syntax no ip access-group frag deny Syntax show log Configuration notes for ACL filtering Syntax no enable ACL-per-port-per-vlanEnter the no form of the command to disable this feature Syntax per-vlan Vlan ID Syntax no ip access-group ACL ID Syntax no ip access-group ACL ID in ethernet port to port ACLs to filter ARP packets Configuration considerations for filtering ARP packets Configuring ACLs for ARP filteringSyntax no ip use-ACL-on-arp access-list-number ACLs to filter ARP packets Filtering on IP precedence and ToS values Displaying ACL filters for ARPClearing the filter count Syntax show ACL-on-arp ethernet port loopback num ve num QoS options for IP ACLs TCP flags edge port security Configuration notes for QoS options on Brocade ICX Using an IP ACL to mark Dscp values Dscp markingSyntax ...dscp-marking dscp-value Combined ACL for 802.1p marking QoS options for IP ACLsFor IP Using an ACL to change the forwarding queue ACL-based rate limitingDscp matching Syntax ...dscp-matching 0 ACLs to control multicast features ACL statisticsEnabling and viewing hardware usage statistics for an ACL Troubleshooting ACLs Syntax show access-list ACL-numACL-nameallDisplaying ACL information Policy Based Routing Configuration considerations for policy-based routing Configuring a PBR policy Configuring the ACLs Configuring the route map Syntax noroute-map map-namepermit deny num Enabling PBR Configuration examples for PBR Setting the next hopBasic example of PBR Policy Based Routing Setting the output interface to the null interface Trunk formation with PBR policy Feature IPv6 ACL overview IPv6 ACL configuration notes IPv6 ACL traffic filtering criteriaIPv6 protocol names and numbers Configuring an IPv6 ACL Example IPv6 configurations Configuring an IPv6 ACL Show ipv6 access-listcommand displays the followingHere is another example Default and implicit IPv6 ACL action Syntax no ipv6 access-list ACL-name Creating an IPv6 ACLSyntax for creating an IPv6 ACL Ipv6-operator dscp For Icmp For TCPFor UDP IPv6 ACL arguments Description Ipv6-source-prefix /prefix-length Creating an IPv6 ACL Syntax descriptions IPv6 ACL arguments Description Icmp message configurations 802.1p-priority-matching number Syntax ipv6 enable Applying an IPv6 ACL to an interface Adding a comment to an IPv6 ACL entry Syntax for applying an IPv6 ACLApplying an IPv6 ACL to a trunk group Syntax .ipv6 traffic-filter ipv6-ACL-namein Deleting a comment from an IPv6 ACL entry Support for ACL loggingDisplaying IPv6 ACLs Syntax show ipv6 access-list Syntax show ipv6 access-list access-list-nameDisplaying IPv6 ACLs ACL-based rate limiting overview Types of ACL-based rate limiting Traffic policies overview Traffic policy structureACL statistics Configuring fixed rate limiting Configuration notes for traffic policies Configuring adaptive rate limiting Configuring adaptive rate limiting ACL based adaptive rate limiting parameters Parameter DefinitionPage Handling packets that exceed the rate limit Dropping packets Enabling and using ACL statistics Permitting packets at low priority Enabling and using ACL statistics Enabling ACL statistics Enabling ACL statistics with rate limiting traffic policies Viewing ACL and rate limit counters Clearing ACL and rate limit counters ACL and rate limit counting statisticsParameter Description General Counters Viewing traffic policies Syntax show traffic-policy TPD-nameParameterDescription 802.1X Port Security Ietf RFC support Device roles in an 802.1X configuration How 802.1X port security worksHow 802.1X port security works Communication between the devices Controlled and uncontrolled ports PAE Message exchange during authentication Setting the IP MTU size Refer to EAP pass-through support on Authenticating multiple hosts connected to the same port Configuration notes for setting the IP MTU sizeEAP pass-through support Syntax no ip mtu num How 802.1X multiple-host authentication works Multiple hosts connected to a single 802.1X-enabled port Configuration notes for 802.1x multiple-host authentication 802.1X port security and sFlow 802.1X port security configuration 802.1X port security configurationConfigure the device role as the Authenticator Configure the device interaction with Clients Configuring an authentication method list for Setting Radius parametersSyntax no aaa authentication dot1x default method-list Supported Radius attributes Specifying the Radius timeout action Permit user access to the network after a Radius timeoutSyntax no dot1x auth-timeout-action success Dynamic Vlan assignment for 802.1X port configuration Re-authenticate a userSyntax no dot1x re-auth-timeout- success seconds Deny user access to the network after a Radius timeout Type Value Dynamic multiple Vlan assignment for 802.1X ports Saving dynamic Vlan assignments to the running-config file Syntax save-dynamicvlan-to-config 802.1X port security configuration Disabled strict security mode Disabling strict security mode globally Syntax no dot1x disable-filter-strict-security ACL or MAC address filter configured on the Brocade deviceDynamically applying existing ACLs or MAC address filters Syntax no global-filter-strict-security Configuring per-user IP ACLs or MAC address filters Value Description Setting the port control Enabling 802.1X port security Configuring periodic re-authentication Syntax no re-authenticationSyntax no timeout re-authperiod seconds Re-authenticating a port manually Setting the quiet periodSetting the wait interval for EAP frame retransmissions Syntax dot1x re-authenticate ethernet port Setting the maximum number of EAP frame retransmissions Syntax no timeout tx-period secondsValue is a number from 1-10. The default is Syntax auth-max value Syntax supptimeout seconds Syntax servertimeout secondsInitializing 802.1X on a port Syntax maxreq value Allowing access to multiple hosts Configuring 802.1X multiple-host authenticationSpecifying the authentication-failure action Syntax no auth-fail-action restricted-vlan This command enables aging of permitted sessions Syntax no auth-fail-max-attempts attemptsDisabling aging for dot1x-mac-sessions Syntax no mac-session-aging no-aging permitted-mac-only Specifying the aging time for blocked clients Syntax no mac-age-time secondsMoving native Vlan mac-sesions to restrict Vlan Syntax clear dot1x mac-session mac-address 802.1X accounting configuration Configuring Vlan access for non-EAP-capable clientsSyntax timeout restrict-fwd-period num MAC address filters for EAP frames To enable 802.1X accounting, enter the following command Syntax aaa accounting dot1x default start-stop radius none802.1X accounting attributes for Radius Enabling 802.1X accounting Displaying 802.1X configuration information Output from the show dot1x commandDisplaying 802.1X information Syntax show dot1x Syntax show dot1x config ethernet port Forceunauth Displaying 802.1X statistics Displaying 802.1X informationSyntax show dot1x statistics ethernet port Field Statistics Clearing 802.1X statistics Displaying dynamically assigned Vlan informationSyntax clear dot1x statistics all Syntax clear dot1x statistics ethernet port Displaying user-defined MAC address filters and IP ACLs Syntax show dot1x mac-address-filterSyntax show dot1x ip-ACL Displaying the status of strict security mode Syntax show dot1x mac-address-filter all ethernet portSyntax show dot1x ip-ACL all ethernet port Displaying 802.1X multiple-host authentication information Global-filter-strict-security Enable Displaying 802.1X multiple-host configuration information Mac Session max-age Seconds Pvid Syntax show dot1x mac-session Output from the show dot1x mac-session brief command Syntax show dot1x mac-session brief Sample 802.1X configurations Point-to-point configurationSame point-to-point 802.1x configuration Sample 802.1X configurations Hub configuration Sample 802.1x configuration using a hub 802.1X authentication with dynamic Vlan assignment Auth-fail-vlanid Page MAC Port Security MAC port security overview Local and global resources used for MAC port security MAC port security configuration Enabling the MAC port security featureSyntax port security Syntax no enable Setting the port security age timer MAC port security configurationSyntax no age minutes Specifying secure MAC addresses On an untagged interfaceOn a tagged interface Dropping packets from a violating address Syntax violation restrictSyntax violation restrict age Clearing port security statistics Clearing restricted MAC addressesClearing violation statistics Disabling the port for a specified amount of time Displaying port security settings Displaying port security informationDisplaying the secure MAC addresses Output from the show port security mac command Output from the show port security statistics port commandDisplaying port security statistics Syntax show port security statistics port Displaying restricted MAC addresses on a port Syntax show port security statistics moduleSyntax show port security ethernet port restricted-macs MAC-based Vlan overview Static and dynamic hosts MAC-based Vlan feature structure Source MAC address authenticationPolicy-based classification and forwarding MAC-based Vlan and port up or down events Dynamic MAC-based Vlan CLI commands Dynamic MAC-based VlanDynamic MAC-based Vlan Description CLI level Dynamic MAC-based Vlan configuration example Dynamic MAC-based Vlan CLI commands for MAC-based VLANsFollowing example shows a MAC-based Vlan configuration CLI command Description CLI level MAC-based Vlan configuration MAC-based Vlan configuration Using MAC-based VLANs and 802.1X security on the same port Attribute ID Data type Optional or Description Mandatory Aging for MAC-based Vlan For permitted hostsFor blocked hosts Aging process for MAC-based Vlan works as described below Disabling aging for MAC-based Vlan sessions For MAC-based dynamic activationTo change the length of the software aging period Globally disabling aging Configuring the maximum MAC addresses per port Configuring a MAC-based Vlan for a static hostSyntax no mac-authentication disable-aging Disabling the aging on interfaces Configuring MAC-based Vlan for a dynamic host Configuring dynamic MAC-based VlanSyntax mac-vlan-permit ethernet stack-unit/slotnum/portnum Configuring MAC-based VLANs using Snmp Enter the following command to display the MAC-VLAN tableDisplaying information about MAC-based VLANs Displaying the MAC-VLAN table Displaying the MAC-VLAN table for a specific MAC address Displaying allowed MAC addressesDisplaying information about MAC-based VLANs Syntax show table-mac-vlan mac-address Displaying denied MAC addresses Syntax show table-mac-vlan denied-mac Default Displaying detailed MAC-VLAN data Displaying MAC-VLAN information for a specific interface Displaying MAC addresses in a MAC-based Vlan Vlan Clearing MAC-VLAN information Sample MAC-based Vlan applicationDisplaying MAC-based Vlan logging Clearing MAC-VLAN information Sample MAC-based Vlan configuration Sample MAC-based Vlan application 0000.0075.3f73 1/1/1 Sample MAC-based Vlan application Multi-Device Port Authentication How multi-device port authentication works Radius authentication Authentication-failure actionsSupported Radius attributes Support for dynamic Vlan assignment Support for dynamic ACLsSupport for dynamic ARP inspection with dynamic ACLs Support for Dhcp snooping with dynamic ACLs Support for source guard protection Configuring Brocade-specific attributes on Radius server Multi-device port authentication configuration Enabling multi-device port authentication Globally enabling multi-device port authenticationEnabling multi-device port authentication on an interface Syntax no mac-authentication enable Specifying the authentication-failure action Multi-device port authentication configurationSyntax no mac-authentication auth-fail-vlan-id vlan-id Generating traps for multi-device port authentication Configuring dynamic Vlan assignmentDefining MAC address filters Syntax no mac-authentication enable-dynamic-vlan Syntax no mac-authentication no-override-restrict-vlan Syntax mac-authentication disable-ingress-filtering Vlan-namestring Configuration notes and limitations Dynamically applying IP ACLs to authenticated MAC addresses Syntax no mac-authentication save-dynamicvlan-to-configPage Enabling denial of service attack protection Configuring the Radius server to support dynamic IP ACLsACLs configured on the Brocade device Syntax no mac-authentication dos-protection mac-limit number Enabling source guard protection Clearing authenticated MAC addresses Syntax no mac-authentication source-guard-protection enableEnter the no form of the command to disable SG protection Syntax clear auth-mac-table Disabling aging for authenticated MAC addresses Syntax mac-authentication clear-mac-session mac-addressGlobally disabling aging of MAC addresses Syntax clear auth-mac-table ethernet port Syntax no mac-authentication hw-deny-age num Disabling the aging of MAC addresses on interfaces Specifying the Radius timeout action Permit user access to the network after a Radius timeoutSyntax no mac-authentication auth-timeout-action success Specifying the aging time for blocked MAC addresses Multi-device port authentication password override Deny user access to the network after a Radius timeoutSyntax no mac-authentication auth-timeout-action failure Displaying multi-device port authentication information Limiting the number of authenticated MAC addressesDisplaying authenticated MAC address information Syntax no mac-authentication password-override password Output from the show authenticated-mac-address command Syntax show auth-mac-address configuration Syntax show auth-mac-address mac-addressip-addrport Displaying the authenticated MAC addresses Syntax show auth-mac-addresses authorized-mac Displaying the non-authenticated MAC addresses Syntax show auth-mac-addresses unauthorized-macExplains the information in the output Syntax show auth-mac-address ethernet port Syntax show auth-mac-address detail ethernet port Output from the show auth-mac-addresses detailed command YES Pvid Example port authentication configurations Example port authentication configurations Interface ethernet 1 dual-modemac-authentication enable Port e1/1/1 Dual Mode Example port authentication configurations Radius Server User 0000.008e.86ac IP Phone Profile No Profile for MAC 0000.007f.2e0a PC User 1 Profile Syntax no mac-authentication auth-fail-dot1x-override Smurf attacks How a Smurf attack floods a victim with Icmp replies Avoiding being an intermediary in a Smurf attack Avoiding being a victim in a Smurf attackSyntax no ip directed-broadcast TCP SYN attacks TCP SYN attacks TCP security enhancement Protecting against a blind injection attack Syntax show statistics dos-attack Syntax clear statistics dos-attack Rate Limiting and Rate Shaping Port-based rate limiting How port-based fixed rate limiting works Rate limiting in hardware Configuration notes for port-based fixed rate limiting Configuring a port-based fixed rate limiting policyDisplaying the port-based fixed rate limiting configuration Syntax no rate-limit input fixed average-rate Configuration notes for rate shaping Configuring outbound rate shaping for a portRate shaping Rate shaping Configuring outbound rate shaping for a specific priority Configuring outbound rate shaping for a trunk portDisplaying rate shaping configurations CPU rate-limiting Packet type Rate limit ARP Dynamic ARP inspection ARP poisoning Dynamic ARP Inspection ARP entries 281 Dynamic ARP inspection configuration Configuring an inspection ARP entryEnabling DAI on a Vlan Syntax no arp ip-addrmac-addrinspection Dhcp snooping Displaying ARP inspection status and portsDisplaying the ARP table Enabling trust on a port How Dhcp snooping works Dhcp binding databasePage Syntax no dhcp snooping client-learning disable Enabling Dhcp snooping on a VlanDisabling the learning of Dhcp clients on a port Syntax no ip dhcp snooping vlan vlan-number Clearing the Dhcp binding database Displaying Dhcp snooping status and portsDisplaying the Dhcp snooping binding database Displaying Dhcp binding entry and status Dhcp snooping configuration example Dhcp relay agent informationDhcp relay agent information Configuration notes for Dhcp option Dhcp option 82 sub-options Sub-option 1 Circuit ID Sub-option 2 Remote IDSub-option 6 Subscriber ID Dhcp option 82 configuration Syntax no dhcp snooping relay information Changing the forwarding policy Enabling and disabling subscriber ID processingSyntax ip dhcp relay information policy policy-type Viewing the ports on which Dhcp option 82 is disabled Output for the ip dhcp relay information commandViewing information about Dhcp option 82 processing Viewing the circuit ID, remote ID, and forwarding policy IP source guard Viewing the status of Dhcp option 82 and the subscriber IDSyntax show interfaces ethernet port Page No source-guard enable Defining static IP source bindingsFor ip-addr, enter a valid IP address Syntax no source-guard enable Enabling IP source guard per-port-per-VLANEnabling IP source guard on a VE Displaying learned IP addresses IP source guard Configuration notes and feature limitations Configuring rate limiting for BUM trafficBroadcast, unknown Unicast, and Multicast rate limiting Viewing rate limits set on BUM traffic Syntax show run interface Syntax show rate-limit broadcast Broadcast, unknown Unicast, and Multicast rate limiting Index ARP Radius Page Page MAC-VLAN Page SSH Ip access-group,110 mac-vlan-permit,220 source-guard enable Vlan