Brocade Communications Systems 6650 specs

Sample 802.1X configurations

Brocade(config)#interface ethernet 1/2/1

Brocade(config-if-e10000-1/2/1)# dot1x port-control auto

Brocade(config-if-e10000-1/2/1)# exit

802.1X authentication with dynamic VLAN assignment

Figure 8 illustrates 802.1X authentication with dynamic VLAN assignment. In this configuration, two user PCs are connected to a hub, which is connected to port e1/2/1. Port e1/2/1 is configured as a dual-mode port. Both PCs transmit untagged traffic. The profile for User 1 on the RADIUS server specifies that User 1 PC should be dynamically assigned to VLAN 3. The RADIUS profile for User 2 on the RADIUS server specifies that User 2 PC should be dynamically assigned to VLAN 20.

FIGURE 8 Sample configuration using 802.1X authentication with dynamic VLAN assignment

RADIUS Server

Tunnel-Private-Group-ID:

User 1 -> “U:3”

User 2 -> “U:20”

Brocade Switch

Port e1/2/1

Dual Mode

Hub

UntaggedUntagged

User 1	User 2
MAC: 0000.007f.2e0a	MAC: 0000.008e.86ac

In this example, the PVID for port e1/2/1 would be changed based on the first host to be successfully authenticated. If User 1 is authenticated first, then the PVID for port e1/2/1 is changed to VLAN 3. If User 2 is authenticated first, then the PVID for port e1/2/1 is changed to VLAN 20. Since a PVID cannot be changed by RADIUS authentication after it has been dynamically assigned, if User 2 is authenticated after the port PVID was changed to VLAN 3, then User 2 would not be able to gain access to the network.

If there were only one device connected to the port, and authentication failed for that device, it could be placed into the restricted VLAN, where it could gain access to the network.

The portion of the running-config related to 802.1X authentication is as follows.

dot1x-enable re-authentication servertimeout 10 timeout re-authperiod 10

auth-fail-action restricted-vlan

198	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01

Image 218

Brocade Communications Systems 6650 manual 802.1X authentication with dynamic Vlan assignment

Contents

Brocade ICX Brocade Communications Systems, Incorporated Contents Brocade ICX 6650 Security Configuration Guide Chapter Brocade ICX 6650 Security Configuration Guide ACL-based rate limiting overview Types of ACL-based rate limiting Chapter 802.1X Port Security Ietf RFC support Local and global resources used for MAC port security MAC-based Vlan feature structureMAC port security overview MAC-based Vlan overview Authentication-failure actions How multi-device port authentication worksRadius authentication Supported Radius attributes Avoiding being a victim in a Smurf attack Smurf attacksAvoiding being an intermediary in a Smurf attack Displaying the port-based fixed rate limiting configuration Configuration notes for port-based fixed rate limitingConfiguring a port-based fixed rate limiting policy Configuration notes and feature limitations for DAI Broadcast, unknown Unicast, and Multicast rate limiting Configuration notes and feature limitationsConfiguring rate limiting for BUM traffic Viewing rate limits set on BUM trafficPage Brocade ICX 6650 slot and port numbering AudienceSupported hardware and software How this document is organized Dhcp on Text formatting Command syntax conventionsDocument conventions Related publications Corporation Referenced Trademarks and Products Brocade resources Additional informationGetting technical help Other industry resources Document feedback Securing access methods Feature Brocade ICX Method is secured Remote access to management function restrictions ACL usage to restrict remote access Syntax telnet access-group num Using an ACL to restrict Telnet accessUsing an ACL to restrict SSH access Syntax ssh access-group num Syntax snmp-server community string ro rw num Using ACLs to restrict Snmp accessDefining the console idle time Restricting SSH access to a specific IP address Remote access restrictionsRestricting Telnet access to a specific IP address Restricting Telnet connection Restricting access to the device based on IP or MAC addressRestricting Snmp access to a specific IP address Restricting SSH connection Restricting Http and Https connection Changing the login timeout period for Telnet sessionsDefining the Telnet idle time Restricting Telnet access to a specific Vlan Syntax no telnet login-retries number Syntax no telnet server enable vlan vlan-id Restricting Snmp access to a specific VlanRestricting Tftp access to a specific Vlan Syntax no snmp-server enable vlan vlan-id Device management security Allowing SSHv2 access to the Brocade deviceSyntax no default-gateway ip-addr metric Syntax crypto key generate zeroize Disabling Telnet access Disabling specific access methodsAllowing Snmp access to the Brocade device Disabling Snmp access Syntax no tftp disable Passwords used to secure accessSetting a Telnet password Syntax no enable telnet password string Syntax no telnet server suppress-reject-message Setting passwords for management privilege levelsPasswords used to secure access Syntax enable read-only-password text Augmenting management privilege levels Enter boot system flash primary at the prompt Recovering from a lost passwordSpecifying a minimum password length After the console prompt reappears, assign a new password Local user accounts Enhancements to username and passwordSyntax enable password-min-length number-of-characters Number-of-characterscan be from Enabling enhanced user password combination requirements Syntax no enable strict-password-enforcement Syntax username name password Enter Enabling user password maskingEnabling user password aging Syntax no enable user password-masking Syntax no enable user password-aging Configuring password historyEnhanced login lockout Syntax no enable user password-history 1 Syntax username name enable Local user account configurationSetting passwords to expire Requirement to accept the message of the day Local user accounts with no passwords Local user accounts with unencrypted passwords Using the username user-stringcreate-password command Creating a password optionLocal accounts with encrypted passwords Syntax show users Tacacs and TACACS+ security Changing a local user passwordSyntax no username user-stringpassword password-string How TACACS+ differs from Tacacs TACACS/TACACS+ authentication, authorization, and accounting Kill console Syntax kill console all unit Tacacs authentication TACACS+ authentication TACACS+ authorization TACACS+ accounting User action Applicable AAA operations AAA security for commands pasted into the running-configAAA operations for TACACS/TACACS+ Configuring TACACS+ TACACS/TACACS+ configuration considerationsConfiguring Tacacs Enabling Tacacs Identifying the TACACS/TACACS+ servers Setting optional Tacacs and TACACS+ parameters Specifying different servers for individual AAA functions Setting the timeout parameter Setting the TACACS+ keySetting the retransmission limit Method parameter Description Syntax no aaa authentication enable implicit-user Entering privileged Exec mode after a Telnet or SSH loginSyntax aaa authentication login privilege-mode Syntax aaa authorization exec default tacacs+ none Configuring TACACS+ authorizationConfiguring Exec authorization Configuring an Attribute-Value pair on the TACACS+ server Foundry-privlvl = Configuring command authorization AAA support for console commands Configuring TACACS+ accounting for CLI commands TACACS+ accounting configurationConfiguring TACACS+ accounting for Telnet/SSH Shell access Syntax no enable aaa console Configuring TACACS+ accounting for system events Output of the show aaa command for TACACS/TACACS+ Radius authentication, authorization, and accountingRadius authentication Radius security Radius authorization Radius accounting AAA operations for Radius AAA operations for Radius Radius configuration considerations Radius security AAA operations for Radius Configuring Radius Brocade-specific attributes on the Radius server Port Configuration level Allows Attribute ID Data type Description Attribute name Attribute ID Data type Description Enabling Snmp to configure RadiusIdentifying the Radius server to the Brocade device Following shows an example configuration Radius server per port configuration notesRadius configuration example and command syntax Radius server per port Syntax use-radius-server ip-addr Radius server-to-ports configuration notesRadius server to individual ports mapping Host ip-addris an IPv4 address Syntax radius-server key 0 1 string Setting the Radius keyRadius parameters Syntax radius-server retransmit number Syntax radius-server timeout number Setting authentication-method lists for RadiusSetting Radius over IPv6 Syntax radius-server host ipv6 ipv6-host address Setting passwords for management privilege levels on Radius authorization Syntax aaa authorization exec default radius none Command authorization and accounting for console commands Radius accounting Configuring Radius accounting for Telnet/SSH Shell accessConfiguring Radius accounting for CLI commands Displaying Radius configuration information Configuring Radius accounting for system events Output of the show aaa command for Radius Authentication-method lists Authentication-method listsExamples of authentication-method lists Example Command SyntaxFollowing is the command syntax for the preceding examples User account configuration on TCP Flags edge port security Using TCP Flags in combination with other ACL features TCP Flags edge port security TCP Flags edge port security SSH2 and SCP SSH version 2 overview Tested SSH2 clients SSH2 supported featuresSSH2 unsupported features Key exchange methods are diffie-hellman-group1-sha1 SSH2 authentication types SSH2 authentication typesConfiguring SSH2 Configure DSA or RSA challenge-response authentication Generating and deleting an RSA key pair Setting the CPU priority for key generationGenerating and deleting a DSA key pair Providing the public key to clients Configuring DSA or RSA challenge-response authenticationDeleting DSA and RSA key pairs Syntax crypto key zeroize Importing authorized public keys into the Brocade device Begin SSH2 Public KEY Optional SSH parameters Enabling DSA or RSA challenge-response authenticationSyntax ip ssh key-authentication yes no Syntax clear public-key Syntax ip ssh authentication-retries number Setting the number of SSH authentication retriesDeactivating user authentication Syntax ip ssh password-authentication no yes Setting the SSH login timeout value Enabling empty password loginsSetting the SSH port number Configuring the maximum idle time for SSH sessions Displaying SSH information Filtering SSH access using ACLsTerminating an active SSH connection Displaying SSH connection information Displaying SSH information Displaying SSH configuration informationSyntax show ip ssh config SSH connection information Displaying SSH information SSH configuration information Displaying additional SSH connection information Copying a file to the running configuration Secure copy configuration notesExample file transfers using SCP Secure copy with SSH2 Copying a software image file to flash memory Copying a file to the startup configurationTo overwrite the running configuration file Copying a software image file from flash memory Importing a DSA or RSA public key Importing a digital certificate using SCPImporting an RSA private key Enabling SSH2 client Configuring SSH2 client public key authenticationSSH2 client Generating and deleting a client RSA key pair Using SSH2 clientGenerating and deleting a client DSA key pair Exporting client public keys Displaying SSH2 client information Supported ACL features on outbound traffic Rule-Based IP ACLs ACL overview Supported ACL features on outbound traffic ACL overview Numbered and named ACLs Types of IP ACLsACL IDs and entries ACL overview Virtual routing interfaces How fragmented packets are processed Default ACL actionHow hardware-based ACLs work Hardware aging of Layer 4 CAM entries ACL configuration considerations Configuring standard numbered ACLs Standard numbered ACL syntax Standard named ACL configuration Configuration example for standard numbered ACLs Syntax no ip access-list standard ACL-nameACL-num Standard named ACL syntax Brocade ICX 6650 Security Configuration Guide 53-1002601-01 Extended numbered ACL configuration Extended numbered ACL configurationConfiguration example for standard named ACLs Extended numbered ACL syntax Num Brocade ICX 6650 Security Configuration Guide 53-1002601-01 Brocade ICX 6650 Security Configuration Guide Configuration examples for extended numbered ACLs Here is another example of an extended ACL Extended named ACL configuration Extended named ACL configuration Extended named ACL syntax Num Brocade ICX 6650 Security Configuration Guide 53-1002601-01 Page Preserving user input for ACL TCP/UDP port numbers Syntax enable egress-acl-on-cpu-trafficApplying egress ACLs to Control CPU traffic Syntax ip preserve-ACL-user-input-format ACL comment text management Adding a comment to an entry in a numbered ACL Deleting a comment from an ACL entry Show running-config Show access-list Show ip access-listAdding a comment to an entry in a named ACL Viewing comments in an ACL Syntax show running-config ACL logging Configuration notes for ACL loggingACL logging Configuration tasks for ACL logging Example ACL logging configuration Syntax ACL-logging Syntax logging-enableDisplaying ACL Log Entries Syntax no ip access-group frag deny Syntax show log Enter the no form of the command to disable this feature Configuration notes for ACL filteringSyntax no enable ACL-per-port-per-vlan Syntax per-vlan Vlan ID Syntax no ip access-group ACL ID Syntax no ip access-group ACL ID in ethernet port to port ACLs to filter ARP packets Syntax no ip use-ACL-on-arp access-list-number Configuration considerations for filtering ARP packetsConfiguring ACLs for ARP filtering ACLs to filter ARP packets Clearing the filter count Filtering on IP precedence and ToS valuesDisplaying ACL filters for ARP Syntax show ACL-on-arp ethernet port loopback num ve num QoS options for IP ACLs TCP flags edge port security Syntax ...dscp-marking dscp-value Configuration notes for QoS options on Brocade ICXUsing an IP ACL to mark Dscp values Dscp marking For IP Combined ACL for 802.1p markingQoS options for IP ACLs Dscp matching Using an ACL to change the forwarding queueACL-based rate limiting Syntax ...dscp-matching 0 Enabling and viewing hardware usage statistics for an ACL ACLs to control multicast featuresACL statistics Displaying ACL information Troubleshooting ACLsSyntax show access-list ACL-numACL-nameall Policy Based Routing Configuration considerations for policy-based routing Configuring a PBR policy Configuring the ACLs Configuring the route map Syntax noroute-map map-namepermit deny num Enabling PBR Basic example of PBR Configuration examples for PBRSetting the next hop Policy Based Routing Setting the output interface to the null interface Trunk formation with PBR policy Feature IPv6 ACL overview IPv6 protocol names and numbers IPv6 ACL configuration notesIPv6 ACL traffic filtering criteria Configuring an IPv6 ACL Example IPv6 configurations Here is another example Configuring an IPv6 ACLShow ipv6 access-listcommand displays the following Default and implicit IPv6 ACL action Syntax for creating an IPv6 ACL Syntax no ipv6 access-list ACL-nameCreating an IPv6 ACL Ipv6-operator dscp For UDP For IcmpFor TCP IPv6 ACL arguments Description Ipv6-source-prefix /prefix-length Creating an IPv6 ACL Syntax descriptions IPv6 ACL arguments Description Icmp message configurations 802.1p-priority-matching number Syntax ipv6 enable Applying an IPv6 ACL to an interface Applying an IPv6 ACL to a trunk group Adding a comment to an IPv6 ACL entrySyntax for applying an IPv6 ACL Syntax .ipv6 traffic-filter ipv6-ACL-namein Displaying IPv6 ACLs Deleting a comment from an IPv6 ACL entrySupport for ACL logging Displaying IPv6 ACLs Syntax show ipv6 access-listSyntax show ipv6 access-list access-list-name ACL-based rate limiting overview Types of ACL-based rate limiting ACL statistics Traffic policies overviewTraffic policy structure Configuring fixed rate limiting Configuration notes for traffic policies Configuring adaptive rate limiting Configuring adaptive rate limiting ACL based adaptive rate limiting parameters Parameter DefinitionPage Handling packets that exceed the rate limit Dropping packets Enabling and using ACL statistics Permitting packets at low priority Enabling and using ACL statistics Enabling ACL statistics Enabling ACL statistics with rate limiting traffic policies Viewing ACL and rate limit counters Parameter Description Clearing ACL and rate limit countersACL and rate limit counting statistics General Counters ParameterDescription Viewing traffic policiesSyntax show traffic-policy TPD-name 802.1X Port Security Ietf RFC support How 802.1X port security works Device roles in an 802.1X configurationHow 802.1X port security works Communication between the devices Controlled and uncontrolled ports PAE Message exchange during authentication Setting the IP MTU size Refer to EAP pass-through support on EAP pass-through support Authenticating multiple hosts connected to the same portConfiguration notes for setting the IP MTU size Syntax no ip mtu num How 802.1X multiple-host authentication works Multiple hosts connected to a single 802.1X-enabled port Configuration notes for 802.1x multiple-host authentication 802.1X port security and sFlow Configure the device role as the Authenticator 802.1X port security configuration802.1X port security configuration Configure the device interaction with Clients Syntax no aaa authentication dot1x default method-list Configuring an authentication method list forSetting Radius parameters Supported Radius attributes Syntax no dot1x auth-timeout-action success Specifying the Radius timeout actionPermit user access to the network after a Radius timeout Syntax no dot1x re-auth-timeout- success seconds Dynamic Vlan assignment for 802.1X port configurationRe-authenticate a user Deny user access to the network after a Radius timeout Type Value Dynamic multiple Vlan assignment for 802.1X ports Saving dynamic Vlan assignments to the running-config file Syntax save-dynamicvlan-to-config 802.1X port security configuration Disabled strict security mode Disabling strict security mode globally Dynamically applying existing ACLs or MAC address filters Syntax no dot1x disable-filter-strict-securityACL or MAC address filter configured on the Brocade device Syntax no global-filter-strict-security Configuring per-user IP ACLs or MAC address filters Value Description Setting the port control Enabling 802.1X port security Syntax no timeout re-authperiod seconds Configuring periodic re-authenticationSyntax no re-authentication Setting the wait interval for EAP frame retransmissions Re-authenticating a port manuallySetting the quiet period Syntax dot1x re-authenticate ethernet port Value is a number from 1-10. The default is Setting the maximum number of EAP frame retransmissionsSyntax no timeout tx-period seconds Syntax auth-max value Initializing 802.1X on a port Syntax supptimeout secondsSyntax servertimeout seconds Syntax maxreq value Specifying the authentication-failure action Allowing access to multiple hostsConfiguring 802.1X multiple-host authentication Syntax no auth-fail-action restricted-vlan Disabling aging for dot1x-mac-sessions This command enables aging of permitted sessionsSyntax no auth-fail-max-attempts attempts Syntax no mac-session-aging no-aging permitted-mac-only Moving native Vlan mac-sesions to restrict Vlan Specifying the aging time for blocked clientsSyntax no mac-age-time seconds Syntax clear dot1x mac-session mac-address Syntax timeout restrict-fwd-period num 802.1X accounting configurationConfiguring Vlan access for non-EAP-capable clients MAC address filters for EAP frames 802.1X accounting attributes for Radius To enable 802.1X accounting, enter the following commandSyntax aaa accounting dot1x default start-stop radius none Enabling 802.1X accounting Displaying 802.1X information Displaying 802.1X configuration informationOutput from the show dot1x command Syntax show dot1x Syntax show dot1x config ethernet port Forceunauth Syntax show dot1x statistics ethernet port Displaying 802.1X statisticsDisplaying 802.1X information Field Statistics Syntax clear dot1x statistics all Clearing 802.1X statisticsDisplaying dynamically assigned Vlan information Syntax clear dot1x statistics ethernet port Syntax show dot1x ip-ACL Displaying user-defined MAC address filters and IP ACLsSyntax show dot1x mac-address-filter Syntax show dot1x ip-ACL all ethernet port Displaying the status of strict security modeSyntax show dot1x mac-address-filter all ethernet port Displaying 802.1X multiple-host authentication information Global-filter-strict-security Enable Displaying 802.1X multiple-host configuration information Mac Session max-age Seconds Pvid Syntax show dot1x mac-session Output from the show dot1x mac-session brief command Syntax show dot1x mac-session brief Same point-to-point 802.1x configuration Sample 802.1X configurationsPoint-to-point configuration Sample 802.1X configurations Hub configuration Sample 802.1x configuration using a hub 802.1X authentication with dynamic Vlan assignment Auth-fail-vlanid Page MAC Port Security MAC port security overview Local and global resources used for MAC port security Syntax port security Syntax no enable MAC port security configurationEnabling the MAC port security feature Syntax no age minutes Setting the port security age timerMAC port security configuration On a tagged interface Specifying secure MAC addressesOn an untagged interface Syntax violation restrict age Dropping packets from a violating addressSyntax violation restrict Clearing violation statistics Clearing port security statisticsClearing restricted MAC addresses Disabling the port for a specified amount of time Displaying the secure MAC addresses Displaying port security settingsDisplaying port security information Displaying port security statistics Output from the show port security mac commandOutput from the show port security statistics port command Syntax show port security statistics port Syntax show port security ethernet port restricted-macs Displaying restricted MAC addresses on a portSyntax show port security statistics module MAC-based Vlan overview Static and dynamic hosts Policy-based classification and forwarding MAC-based Vlan feature structureSource MAC address authentication MAC-based Vlan and port up or down events Dynamic MAC-based Vlan Dynamic MAC-based Vlan CLI commandsDynamic MAC-based Vlan Description CLI level Following example shows a MAC-based Vlan configuration Dynamic MAC-based Vlan configuration exampleDynamic MAC-based Vlan CLI commands for MAC-based VLANs CLI command Description CLI level MAC-based Vlan configuration MAC-based Vlan configuration Using MAC-based VLANs and 802.1X security on the same port Attribute ID Data type Optional or Description Mandatory For blocked hosts Aging for MAC-based VlanFor permitted hosts Aging process for MAC-based Vlan works as described below To change the length of the software aging period Disabling aging for MAC-based Vlan sessionsFor MAC-based dynamic activation Globally disabling aging Syntax no mac-authentication disable-aging Configuring the maximum MAC addresses per portConfiguring a MAC-based Vlan for a static host Disabling the aging on interfaces Syntax mac-vlan-permit ethernet stack-unit/slotnum/portnum Configuring MAC-based Vlan for a dynamic hostConfiguring dynamic MAC-based Vlan Displaying information about MAC-based VLANs Configuring MAC-based VLANs using SnmpEnter the following command to display the MAC-VLAN table Displaying the MAC-VLAN table Displaying information about MAC-based VLANs Displaying the MAC-VLAN table for a specific MAC addressDisplaying allowed MAC addresses Syntax show table-mac-vlan mac-address Displaying denied MAC addresses Syntax show table-mac-vlan denied-mac Default Displaying detailed MAC-VLAN data Displaying MAC-VLAN information for a specific interface Displaying MAC addresses in a MAC-based Vlan Vlan Displaying MAC-based Vlan logging Clearing MAC-VLAN informationSample MAC-based Vlan application Clearing MAC-VLAN information Sample MAC-based Vlan configuration Sample MAC-based Vlan application 0000.0075.3f73 1/1/1 Sample MAC-based Vlan application Multi-Device Port Authentication How multi-device port authentication works Supported Radius attributes Radius authenticationAuthentication-failure actions Support for dynamic ARP inspection with dynamic ACLs Support for dynamic Vlan assignmentSupport for dynamic ACLs Support for Dhcp snooping with dynamic ACLs Support for source guard protection Configuring Brocade-specific attributes on Radius server Multi-device port authentication configuration Enabling multi-device port authentication on an interface Enabling multi-device port authenticationGlobally enabling multi-device port authentication Syntax no mac-authentication enable Syntax no mac-authentication auth-fail-vlan-id vlan-id Specifying the authentication-failure actionMulti-device port authentication configuration Defining MAC address filters Generating traps for multi-device port authenticationConfiguring dynamic Vlan assignment Syntax no mac-authentication enable-dynamic-vlan Syntax no mac-authentication no-override-restrict-vlan Syntax mac-authentication disable-ingress-filtering Vlan-namestring Configuration notes and limitations Dynamically applying IP ACLs to authenticated MAC addresses Syntax no mac-authentication save-dynamicvlan-to-configPage ACLs configured on the Brocade device Enabling denial of service attack protectionConfiguring the Radius server to support dynamic IP ACLs Syntax no mac-authentication dos-protection mac-limit number Enabling source guard protection Enter the no form of the command to disable SG protection Clearing authenticated MAC addressesSyntax no mac-authentication source-guard-protection enable Syntax clear auth-mac-table Globally disabling aging of MAC addresses Disabling aging for authenticated MAC addressesSyntax mac-authentication clear-mac-session mac-address Syntax clear auth-mac-table ethernet port Syntax no mac-authentication hw-deny-age num Disabling the aging of MAC addresses on interfaces Syntax no mac-authentication auth-timeout-action success Specifying the Radius timeout actionPermit user access to the network after a Radius timeout Specifying the aging time for blocked MAC addresses Syntax no mac-authentication auth-timeout-action failure Multi-device port authentication password overrideDeny user access to the network after a Radius timeout Displaying authenticated MAC address information Displaying multi-device port authentication informationLimiting the number of authenticated MAC addresses Syntax no mac-authentication password-override password Output from the show authenticated-mac-address command Syntax show auth-mac-address configuration Syntax show auth-mac-address mac-addressip-addrport Displaying the authenticated MAC addresses Syntax show auth-mac-addresses authorized-mac Explains the information in the output Displaying the non-authenticated MAC addressesSyntax show auth-mac-addresses unauthorized-mac Syntax show auth-mac-address ethernet port Syntax show auth-mac-address detail ethernet port Output from the show auth-mac-addresses detailed command YES Pvid Example port authentication configurations Example port authentication configurations Interface ethernet 1 dual-modemac-authentication enable Port e1/1/1 Dual Mode Example port authentication configurations Radius Server User 0000.008e.86ac IP Phone Profile No Profile for MAC 0000.007f.2e0a PC User 1 Profile Syntax no mac-authentication auth-fail-dot1x-override Smurf attacks How a Smurf attack floods a victim with Icmp replies Syntax no ip directed-broadcast Avoiding being an intermediary in a Smurf attackAvoiding being a victim in a Smurf attack TCP SYN attacks TCP SYN attacks TCP security enhancement Protecting against a blind injection attack Syntax show statistics dos-attack Syntax clear statistics dos-attack Rate Limiting and Rate Shaping Port-based rate limiting How port-based fixed rate limiting works Rate limiting in hardware Displaying the port-based fixed rate limiting configuration Configuration notes for port-based fixed rate limitingConfiguring a port-based fixed rate limiting policy Syntax no rate-limit input fixed average-rate Rate shaping Configuration notes for rate shapingConfiguring outbound rate shaping for a port Rate shaping Displaying rate shaping configurations Configuring outbound rate shaping for a specific priorityConfiguring outbound rate shaping for a trunk port CPU rate-limiting Packet type Rate limit ARP Dynamic ARP inspection ARP poisoning Dynamic ARP Inspection ARP entries 281 Enabling DAI on a Vlan Dynamic ARP inspection configurationConfiguring an inspection ARP entry Syntax no arp ip-addrmac-addrinspection Displaying the ARP table Dhcp snoopingDisplaying ARP inspection status and ports Enabling trust on a port How Dhcp snooping works Dhcp binding databasePage Disabling the learning of Dhcp clients on a port Syntax no dhcp snooping client-learning disableEnabling Dhcp snooping on a Vlan Syntax no ip dhcp snooping vlan vlan-number Displaying the Dhcp snooping binding database Clearing the Dhcp binding databaseDisplaying Dhcp snooping status and ports Displaying Dhcp binding entry and status Dhcp relay agent information Dhcp snooping configuration exampleDhcp relay agent information Configuration notes for Dhcp option Dhcp option 82 sub-options Sub-option 6 Subscriber ID Sub-option 1 Circuit IDSub-option 2 Remote ID Dhcp option 82 configuration Syntax no dhcp snooping relay information Syntax ip dhcp relay information policy policy-type Changing the forwarding policyEnabling and disabling subscriber ID processing Viewing information about Dhcp option 82 processing Viewing the ports on which Dhcp option 82 is disabledOutput for the ip dhcp relay information command Viewing the circuit ID, remote ID, and forwarding policy Syntax show interfaces ethernet port IP source guardViewing the status of Dhcp option 82 and the subscriber ID Page For ip-addr, enter a valid IP address No source-guard enableDefining static IP source bindings Enabling IP source guard on a VE Syntax no source-guard enableEnabling IP source guard per-port-per-VLAN Displaying learned IP addresses IP source guard Broadcast, unknown Unicast, and Multicast rate limiting Configuration notes and feature limitationsConfiguring rate limiting for BUM traffic Viewing rate limits set on BUM traffic Syntax show run interface Syntax show rate-limit broadcast Broadcast, unknown Unicast, and Multicast rate limiting Index ARP Radius Page Page MAC-VLAN Page SSH Ip access-group,110 mac-vlan-permit,220 source-guard enable Vlan