Brocade ICX
Brocade Communications Systems, Incorporated
Contents
Brocade ICX 6650 Security Configuration Guide
Chapter
Brocade ICX 6650 Security Configuration Guide
ACL-based rate limiting overview
Types of ACL-based rate limiting
Chapter 802.1X Port Security
Ietf RFC support
MAC-based Vlan feature structure
MAC port security overview
Local and global resources used for MAC port security
MAC-based Vlan overview
How multi-device port authentication works
Radius authentication
Authentication-failure actions
Supported Radius attributes
Avoiding being a victim in a Smurf attack
Smurf attacks
Avoiding being an intermediary in a Smurf attack
Configuration notes for port-based fixed rate limiting
Configuring a port-based fixed rate limiting policy
Displaying the port-based fixed rate limiting configuration
Configuration notes and feature limitations for DAI
Configuration notes and feature limitations
Configuring rate limiting for BUM traffic
Broadcast, unknown Unicast, and Multicast rate limiting
Viewing rate limits set on BUM traffic
Page
Brocade ICX 6650 slot and port numbering
Audience
Supported hardware and software
How this document is organized
Dhcp on
Text formatting
Command syntax conventions
Document conventions
Related publications
Corporation Referenced Trademarks and Products
Additional information
Getting technical help
Brocade resources
Other industry resources
Document feedback
Securing access methods
Feature Brocade ICX
Method is secured
Remote access to management function restrictions
ACL usage to restrict remote access
Using an ACL to restrict Telnet access
Using an ACL to restrict SSH access
Syntax telnet access-group num
Syntax ssh access-group num
Syntax snmp-server community string ro rw num
Using ACLs to restrict Snmp access
Defining the console idle time
Restricting SSH access to a specific IP address
Remote access restrictions
Restricting Telnet access to a specific IP address
Restricting access to the device based on IP or MAC address
Restricting Snmp access to a specific IP address
Restricting Telnet connection
Restricting SSH connection
Restricting Http and Https connection
Changing the login timeout period for Telnet sessions
Defining the Telnet idle time
Restricting Telnet access to a specific Vlan
Syntax no telnet login-retries number
Restricting Snmp access to a specific Vlan
Restricting Tftp access to a specific Vlan
Syntax no telnet server enable vlan vlan-id
Syntax no snmp-server enable vlan vlan-id
Allowing SSHv2 access to the Brocade device
Syntax no default-gateway ip-addr metric
Device management security
Syntax crypto key generate zeroize
Disabling specific access methods
Allowing Snmp access to the Brocade device
Disabling Telnet access
Disabling Snmp access
Passwords used to secure access
Setting a Telnet password
Syntax no tftp disable
Syntax no enable telnet password string
Syntax no telnet server suppress-reject-message
Setting passwords for management privilege levels
Passwords used to secure access
Syntax enable read-only-password text
Augmenting management privilege levels
Recovering from a lost password
Specifying a minimum password length
Enter boot system flash primary at the prompt
After the console prompt reappears, assign a new password
Enhancements to username and password
Syntax enable password-min-length number-of-characters
Local user accounts
Number-of-characterscan be from
Enabling enhanced user password combination requirements
Syntax no enable strict-password-enforcement
Enabling user password masking
Enabling user password aging
Syntax username name password Enter
Syntax no enable user password-masking
Configuring password history
Enhanced login lockout
Syntax no enable user password-aging
Syntax no enable user password-history 1
Local user account configuration
Setting passwords to expire
Syntax username name enable
Requirement to accept the message of the day
Local user accounts with no passwords
Local user accounts with unencrypted passwords
Creating a password option
Local accounts with encrypted passwords
Using the username user-stringcreate-password command
Syntax show users
Changing a local user password
Syntax no username user-stringpassword password-string
Tacacs and TACACS+ security
How TACACS+ differs from Tacacs
TACACS/TACACS+ authentication, authorization, and accounting
Kill console Syntax kill console all unit
Tacacs authentication
TACACS+ authentication
TACACS+ authorization
TACACS+ accounting
User action Applicable AAA operations
AAA security for commands pasted into the running-config
AAA operations for TACACS/TACACS+
Configuring TACACS+
TACACS/TACACS+ configuration considerations
Configuring Tacacs
Enabling Tacacs
Identifying the TACACS/TACACS+ servers
Setting optional Tacacs and TACACS+ parameters
Specifying different servers for individual AAA functions
Setting the timeout parameter
Setting the TACACS+ key
Setting the retransmission limit
Method parameter Description
Syntax no aaa authentication enable implicit-user
Entering privileged Exec mode after a Telnet or SSH login
Syntax aaa authentication login privilege-mode
Configuring TACACS+ authorization
Configuring Exec authorization
Syntax aaa authorization exec default tacacs+ none
Configuring an Attribute-Value pair on the TACACS+ server
Foundry-privlvl =
Configuring command authorization
AAA support for console commands
TACACS+ accounting configuration
Configuring TACACS+ accounting for Telnet/SSH Shell access
Configuring TACACS+ accounting for CLI commands
Syntax no enable aaa console
Configuring TACACS+ accounting for system events
Radius authentication, authorization, and accounting
Radius authentication
Output of the show aaa command for TACACS/TACACS+
Radius security
Radius authorization
Radius accounting
AAA operations for Radius
AAA operations for Radius
Radius configuration considerations
Radius security AAA operations for Radius
Configuring Radius
Brocade-specific attributes on the Radius server
Port Configuration level Allows
Attribute ID Data type Description
Attribute name Attribute ID Data type Description
Enabling Snmp to configure Radius
Identifying the Radius server to the Brocade device
Radius server per port configuration notes
Radius configuration example and command syntax
Following shows an example configuration
Radius server per port
Radius server-to-ports configuration notes
Radius server to individual ports mapping
Syntax use-radius-server ip-addr
Host ip-addris an IPv4 address
Setting the Radius key
Radius parameters
Syntax radius-server key 0 1 string
Syntax radius-server retransmit number
Setting authentication-method lists for Radius
Setting Radius over IPv6
Syntax radius-server timeout number
Syntax radius-server host ipv6 ipv6-host address
Setting passwords for management privilege levels on
Radius authorization
Syntax aaa authorization exec default radius none
Command authorization and accounting for console commands
Radius accounting
Configuring Radius accounting for Telnet/SSH Shell access
Configuring Radius accounting for CLI commands
Displaying Radius configuration information
Configuring Radius accounting for system events
Output of the show aaa command for Radius
Authentication-method lists
Authentication-method lists
Examples of authentication-method lists
Example
Command Syntax
Following is the command syntax for the preceding examples
User account configuration on
TCP Flags edge port security
Using TCP Flags in combination with other ACL features
TCP Flags edge port security
TCP Flags edge port security
SSH2 and SCP
SSH version 2 overview
SSH2 supported features
SSH2 unsupported features
Tested SSH2 clients
Key exchange methods are diffie-hellman-group1-sha1
SSH2 authentication types
Configuring SSH2
SSH2 authentication types
Configure DSA or RSA challenge-response authentication
Generating and deleting an RSA key pair
Setting the CPU priority for key generation
Generating and deleting a DSA key pair
Configuring DSA or RSA challenge-response authentication
Deleting DSA and RSA key pairs
Providing the public key to clients
Syntax crypto key zeroize
Importing authorized public keys into the Brocade device
Begin SSH2 Public KEY
Enabling DSA or RSA challenge-response authentication
Syntax ip ssh key-authentication yes no
Optional SSH parameters
Syntax clear public-key
Setting the number of SSH authentication retries
Deactivating user authentication
Syntax ip ssh authentication-retries number
Syntax ip ssh password-authentication no yes
Enabling empty password logins
Setting the SSH port number
Setting the SSH login timeout value
Configuring the maximum idle time for SSH sessions
Filtering SSH access using ACLs
Terminating an active SSH connection
Displaying SSH information
Displaying SSH connection information
Displaying SSH configuration information
Syntax show ip ssh config
Displaying SSH information
SSH connection information
Displaying SSH information SSH configuration information
Displaying additional SSH connection information
Secure copy configuration notes
Example file transfers using SCP
Copying a file to the running configuration
Secure copy with SSH2
Copying a file to the startup configuration
To overwrite the running configuration file
Copying a software image file to flash memory
Copying a software image file from flash memory
Importing a DSA or RSA public key
Importing a digital certificate using SCP
Importing an RSA private key
Enabling SSH2 client
Configuring SSH2 client public key authentication
SSH2 client
Using SSH2 client
Generating and deleting a client DSA key pair
Generating and deleting a client RSA key pair
Exporting client public keys
Displaying SSH2 client information
Supported ACL features on outbound traffic
Rule-Based IP ACLs
ACL overview Supported ACL features on outbound traffic
ACL overview
Types of IP ACLs
ACL IDs and entries
Numbered and named ACLs
ACL overview Virtual routing interfaces
Default ACL action
How hardware-based ACLs work
How fragmented packets are processed
Hardware aging of Layer 4 CAM entries
ACL configuration considerations
Configuring standard numbered ACLs
Standard numbered ACL syntax
Standard named ACL configuration
Configuration example for standard numbered ACLs
Syntax no ip access-list standard ACL-nameACL-num
Standard named ACL syntax
Brocade ICX 6650 Security Configuration Guide 53-1002601-01
Extended numbered ACL configuration
Extended numbered ACL configuration
Configuration example for standard named ACLs
Extended numbered ACL syntax
Num
Brocade ICX 6650 Security Configuration Guide 53-1002601-01
Brocade ICX 6650 Security Configuration Guide
Configuration examples for extended numbered ACLs
Here is another example of an extended ACL
Extended named ACL configuration
Extended named ACL configuration
Extended named ACL syntax
Num
Brocade ICX 6650 Security Configuration Guide 53-1002601-01
Page
Syntax enable egress-acl-on-cpu-traffic
Applying egress ACLs to Control CPU traffic
Preserving user input for ACL TCP/UDP port numbers
Syntax ip preserve-ACL-user-input-format
ACL comment text management
Adding a comment to an entry in a numbered ACL
Show running-config Show access-list Show ip access-list
Adding a comment to an entry in a named ACL
Deleting a comment from an ACL entry
Viewing comments in an ACL
Syntax show running-config
ACL logging
Configuration notes for ACL logging
ACL logging
Configuration tasks for ACL logging
Example ACL logging configuration
Syntax ACL-logging
Syntax logging-enable
Displaying ACL Log Entries
Syntax no ip access-group frag deny
Syntax show log
Enter the no form of the command to disable this feature
Configuration notes for ACL filtering
Syntax no enable ACL-per-port-per-vlan
Syntax per-vlan Vlan ID Syntax no ip access-group ACL ID
Syntax no ip access-group ACL ID in ethernet port to port
ACLs to filter ARP packets
Configuration considerations for filtering ARP packets
Configuring ACLs for ARP filtering
Syntax no ip use-ACL-on-arp access-list-number
ACLs to filter ARP packets
Filtering on IP precedence and ToS values
Displaying ACL filters for ARP
Clearing the filter count
Syntax show ACL-on-arp ethernet port loopback num ve num
QoS options for IP ACLs
TCP flags edge port security
Syntax ...dscp-marking dscp-value
Configuration notes for QoS options on Brocade ICX
Using an IP ACL to mark Dscp values Dscp marking
For IP
Combined ACL for 802.1p marking
QoS options for IP ACLs
Using an ACL to change the forwarding queue
ACL-based rate limiting
Dscp matching
Syntax ...dscp-matching 0
Enabling and viewing hardware usage statistics for an ACL
ACLs to control multicast features
ACL statistics
Troubleshooting ACLs
Syntax show access-list ACL-numACL-nameall
Displaying ACL information
Policy Based Routing
Configuration considerations for policy-based routing
Configuring a PBR policy
Configuring the ACLs
Configuring the route map
Syntax noroute-map map-namepermit deny num
Enabling PBR
Configuration examples for PBR
Setting the next hop
Basic example of PBR
Policy Based Routing
Setting the output interface to the null interface
Trunk formation with PBR policy
Feature
IPv6 ACL overview
IPv6 protocol names and numbers
IPv6 ACL configuration notes
IPv6 ACL traffic filtering criteria
Configuring an IPv6 ACL
Example IPv6 configurations
Here is another example
Configuring an IPv6 ACL
Show ipv6 access-listcommand displays the following
Default and implicit IPv6 ACL action
Syntax no ipv6 access-list ACL-name
Creating an IPv6 ACL
Syntax for creating an IPv6 ACL
Ipv6-operator dscp
For UDP
For Icmp
For TCP
IPv6 ACL arguments Description
Ipv6-source-prefix /prefix-length
Creating an IPv6 ACL Syntax descriptions
IPv6 ACL arguments Description
Icmp message configurations
802.1p-priority-matching number
Syntax ipv6 enable
Applying an IPv6 ACL to an interface
Adding a comment to an IPv6 ACL entry
Syntax for applying an IPv6 ACL
Applying an IPv6 ACL to a trunk group
Syntax .ipv6 traffic-filter ipv6-ACL-namein
Displaying IPv6 ACLs
Deleting a comment from an IPv6 ACL entry
Support for ACL logging
Displaying IPv6 ACLs
Syntax show ipv6 access-list
Syntax show ipv6 access-list access-list-name
ACL-based rate limiting overview
Types of ACL-based rate limiting
ACL statistics
Traffic policies overview
Traffic policy structure
Configuring fixed rate limiting
Configuration notes for traffic policies
Configuring adaptive rate limiting
Configuring adaptive rate limiting
ACL based adaptive rate limiting parameters
Parameter Definition
Page
Handling packets that exceed the rate limit
Dropping packets
Enabling and using ACL statistics
Permitting packets at low priority
Enabling and using ACL statistics
Enabling ACL statistics
Enabling ACL statistics with rate limiting traffic policies
Viewing ACL and rate limit counters
Clearing ACL and rate limit counters
ACL and rate limit counting statistics
Parameter Description
General Counters
ParameterDescription
Viewing traffic policies
Syntax show traffic-policy TPD-name
802.1X Port Security
Ietf RFC support
How 802.1X port security works
Device roles in an 802.1X configuration
How 802.1X port security works
Communication between the devices
Controlled and uncontrolled ports
PAE
Message exchange during authentication
Setting the IP MTU size
Refer to EAP pass-through support on
Authenticating multiple hosts connected to the same port
Configuration notes for setting the IP MTU size
EAP pass-through support
Syntax no ip mtu num
How 802.1X multiple-host authentication works
Multiple hosts connected to a single 802.1X-enabled port
Configuration notes for 802.1x multiple-host authentication
802.1X port security and sFlow
802.1X port security configuration
802.1X port security configuration
Configure the device role as the Authenticator
Configure the device interaction with Clients
Configuring an authentication method list for
Setting Radius parameters
Syntax no aaa authentication dot1x default method-list
Supported Radius attributes
Syntax no dot1x auth-timeout-action success
Specifying the Radius timeout action
Permit user access to the network after a Radius timeout
Dynamic Vlan assignment for 802.1X port configuration
Re-authenticate a user
Syntax no dot1x re-auth-timeout- success seconds
Deny user access to the network after a Radius timeout
Type Value
Dynamic multiple Vlan assignment for 802.1X ports
Saving dynamic Vlan assignments to the running-config file
Syntax save-dynamicvlan-to-config
802.1X port security configuration
Disabled strict security mode
Disabling strict security mode globally
Syntax no dot1x disable-filter-strict-security
ACL or MAC address filter configured on the Brocade device
Dynamically applying existing ACLs or MAC address filters
Syntax no global-filter-strict-security
Configuring per-user IP ACLs or MAC address filters
Value Description
Setting the port control
Enabling 802.1X port security
Syntax no timeout re-authperiod seconds
Configuring periodic re-authentication
Syntax no re-authentication
Re-authenticating a port manually
Setting the quiet period
Setting the wait interval for EAP frame retransmissions
Syntax dot1x re-authenticate ethernet port
Setting the maximum number of EAP frame retransmissions
Syntax no timeout tx-period seconds
Value is a number from 1-10. The default is
Syntax auth-max value
Syntax supptimeout seconds
Syntax servertimeout seconds
Initializing 802.1X on a port
Syntax maxreq value
Allowing access to multiple hosts
Configuring 802.1X multiple-host authentication
Specifying the authentication-failure action
Syntax no auth-fail-action restricted-vlan
This command enables aging of permitted sessions
Syntax no auth-fail-max-attempts attempts
Disabling aging for dot1x-mac-sessions
Syntax no mac-session-aging no-aging permitted-mac-only
Specifying the aging time for blocked clients
Syntax no mac-age-time seconds
Moving native Vlan mac-sesions to restrict Vlan
Syntax clear dot1x mac-session mac-address
802.1X accounting configuration
Configuring Vlan access for non-EAP-capable clients
Syntax timeout restrict-fwd-period num
MAC address filters for EAP frames
To enable 802.1X accounting, enter the following command
Syntax aaa accounting dot1x default start-stop radius none
802.1X accounting attributes for Radius
Enabling 802.1X accounting
Displaying 802.1X configuration information
Output from the show dot1x command
Displaying 802.1X information
Syntax show dot1x
Syntax show dot1x config ethernet port
Forceunauth
Displaying 802.1X statistics
Displaying 802.1X information
Syntax show dot1x statistics ethernet port
Field Statistics
Clearing 802.1X statistics
Displaying dynamically assigned Vlan information
Syntax clear dot1x statistics all
Syntax clear dot1x statistics ethernet port
Syntax show dot1x ip-ACL
Displaying user-defined MAC address filters and IP ACLs
Syntax show dot1x mac-address-filter
Syntax show dot1x ip-ACL all ethernet port
Displaying the status of strict security mode
Syntax show dot1x mac-address-filter all ethernet port
Displaying 802.1X multiple-host authentication information
Global-filter-strict-security Enable
Displaying 802.1X multiple-host configuration information
Mac Session max-age Seconds
Pvid
Syntax show dot1x mac-session
Output from the show dot1x mac-session brief command
Syntax show dot1x mac-session brief
Sample 802.1X configurations
Point-to-point configuration
Same point-to-point 802.1x configuration
Sample 802.1X configurations
Hub configuration
Sample 802.1x configuration using a hub
802.1X authentication with dynamic Vlan assignment
Auth-fail-vlanid
Page
MAC Port Security
MAC port security overview
Local and global resources used for MAC port security
Syntax port security Syntax no enable
MAC port security configuration
Enabling the MAC port security feature
Syntax no age minutes
Setting the port security age timer
MAC port security configuration
On a tagged interface
Specifying secure MAC addresses
On an untagged interface
Syntax violation restrict age
Dropping packets from a violating address
Syntax violation restrict
Clearing port security statistics
Clearing restricted MAC addresses
Clearing violation statistics
Disabling the port for a specified amount of time
Displaying the secure MAC addresses
Displaying port security settings
Displaying port security information
Output from the show port security mac command
Output from the show port security statistics port command
Displaying port security statistics
Syntax show port security statistics port
Syntax show port security ethernet port restricted-macs
Displaying restricted MAC addresses on a port
Syntax show port security statistics module
MAC-based Vlan overview
Static and dynamic hosts
MAC-based Vlan feature structure
Source MAC address authentication
Policy-based classification and forwarding
MAC-based Vlan and port up or down events
Dynamic MAC-based Vlan CLI commands
Dynamic MAC-based Vlan
Dynamic MAC-based Vlan
Description CLI level
Dynamic MAC-based Vlan configuration example
Dynamic MAC-based Vlan CLI commands for MAC-based VLANs
Following example shows a MAC-based Vlan configuration
CLI command Description CLI level
MAC-based Vlan configuration
MAC-based Vlan configuration
Using MAC-based VLANs and 802.1X security on the same port
Attribute ID Data type Optional or Description Mandatory
Aging for MAC-based Vlan
For permitted hosts
For blocked hosts
Aging process for MAC-based Vlan works as described below
Disabling aging for MAC-based Vlan sessions
For MAC-based dynamic activation
To change the length of the software aging period
Globally disabling aging
Configuring the maximum MAC addresses per port
Configuring a MAC-based Vlan for a static host
Syntax no mac-authentication disable-aging
Disabling the aging on interfaces
Syntax mac-vlan-permit ethernet stack-unit/slotnum/portnum
Configuring MAC-based Vlan for a dynamic host
Configuring dynamic MAC-based Vlan
Configuring MAC-based VLANs using Snmp
Enter the following command to display the MAC-VLAN table
Displaying information about MAC-based VLANs
Displaying the MAC-VLAN table
Displaying the MAC-VLAN table for a specific MAC address
Displaying allowed MAC addresses
Displaying information about MAC-based VLANs
Syntax show table-mac-vlan mac-address
Displaying denied MAC addresses
Syntax show table-mac-vlan denied-mac
Default
Displaying detailed MAC-VLAN data
Displaying MAC-VLAN information for a specific interface
Displaying MAC addresses in a MAC-based Vlan
Vlan
Clearing MAC-VLAN information
Sample MAC-based Vlan application
Displaying MAC-based Vlan logging
Clearing MAC-VLAN information
Sample MAC-based Vlan configuration
Sample MAC-based Vlan application
0000.0075.3f73 1/1/1
Sample MAC-based Vlan application
Multi-Device Port Authentication
How multi-device port authentication works
Supported Radius attributes
Radius authentication
Authentication-failure actions
Support for dynamic ARP inspection with dynamic ACLs
Support for dynamic Vlan assignment
Support for dynamic ACLs
Support for Dhcp snooping with dynamic ACLs
Support for source guard protection
Configuring Brocade-specific attributes on Radius server
Multi-device port authentication configuration
Enabling multi-device port authentication
Globally enabling multi-device port authentication
Enabling multi-device port authentication on an interface
Syntax no mac-authentication enable
Syntax no mac-authentication auth-fail-vlan-id vlan-id
Specifying the authentication-failure action
Multi-device port authentication configuration
Defining MAC address filters
Generating traps for multi-device port authentication
Configuring dynamic Vlan assignment
Syntax no mac-authentication enable-dynamic-vlan
Syntax no mac-authentication no-override-restrict-vlan
Syntax mac-authentication disable-ingress-filtering
Vlan-namestring
Configuration notes and limitations
Dynamically applying IP ACLs to authenticated MAC addresses
Syntax no mac-authentication save-dynamicvlan-to-config
Page
ACLs configured on the Brocade device
Enabling denial of service attack protection
Configuring the Radius server to support dynamic IP ACLs
Syntax no mac-authentication dos-protection mac-limit number
Enabling source guard protection
Clearing authenticated MAC addresses
Syntax no mac-authentication source-guard-protection enable
Enter the no form of the command to disable SG protection
Syntax clear auth-mac-table
Disabling aging for authenticated MAC addresses
Syntax mac-authentication clear-mac-session mac-address
Globally disabling aging of MAC addresses
Syntax clear auth-mac-table ethernet port
Syntax no mac-authentication hw-deny-age num
Disabling the aging of MAC addresses on interfaces
Specifying the Radius timeout action
Permit user access to the network after a Radius timeout
Syntax no mac-authentication auth-timeout-action success
Specifying the aging time for blocked MAC addresses
Syntax no mac-authentication auth-timeout-action failure
Multi-device port authentication password override
Deny user access to the network after a Radius timeout
Displaying multi-device port authentication information
Limiting the number of authenticated MAC addresses
Displaying authenticated MAC address information
Syntax no mac-authentication password-override password
Output from the show authenticated-mac-address command
Syntax show auth-mac-address configuration
Syntax show auth-mac-address mac-addressip-addrport
Displaying the authenticated MAC addresses
Syntax show auth-mac-addresses authorized-mac
Displaying the non-authenticated MAC addresses
Syntax show auth-mac-addresses unauthorized-mac
Explains the information in the output
Syntax show auth-mac-address ethernet port
Syntax show auth-mac-address detail ethernet port
Output from the show auth-mac-addresses detailed command
YES
Pvid
Example port authentication configurations
Example port authentication configurations
Interface ethernet 1 dual-modemac-authentication enable
Port e1/1/1 Dual Mode
Example port authentication configurations
Radius Server User 0000.008e.86ac IP Phone Profile
No Profile for MAC 0000.007f.2e0a PC User 1 Profile
Syntax no mac-authentication auth-fail-dot1x-override
Smurf attacks
How a Smurf attack floods a victim with Icmp replies
Syntax no ip directed-broadcast
Avoiding being an intermediary in a Smurf attack
Avoiding being a victim in a Smurf attack
TCP SYN attacks
TCP SYN attacks
TCP security enhancement
Protecting against a blind injection attack
Syntax show statistics dos-attack
Syntax clear statistics dos-attack
Rate Limiting and Rate Shaping
Port-based rate limiting
How port-based fixed rate limiting works
Rate limiting in hardware
Configuration notes for port-based fixed rate limiting
Configuring a port-based fixed rate limiting policy
Displaying the port-based fixed rate limiting configuration
Syntax no rate-limit input fixed average-rate
Configuration notes for rate shaping
Configuring outbound rate shaping for a port
Rate shaping
Rate shaping
Configuring outbound rate shaping for a specific priority
Configuring outbound rate shaping for a trunk port
Displaying rate shaping configurations
CPU rate-limiting
Packet type Rate limit
ARP
Dynamic ARP inspection
ARP poisoning
Dynamic ARP Inspection
ARP entries
281
Dynamic ARP inspection configuration
Configuring an inspection ARP entry
Enabling DAI on a Vlan
Syntax no arp ip-addrmac-addrinspection
Dhcp snooping
Displaying ARP inspection status and ports
Displaying the ARP table
Enabling trust on a port
How Dhcp snooping works
Dhcp binding database
Page
Syntax no dhcp snooping client-learning disable
Enabling Dhcp snooping on a Vlan
Disabling the learning of Dhcp clients on a port
Syntax no ip dhcp snooping vlan vlan-number
Clearing the Dhcp binding database
Displaying Dhcp snooping status and ports
Displaying the Dhcp snooping binding database
Displaying Dhcp binding entry and status
Dhcp relay agent information
Dhcp snooping configuration example
Dhcp relay agent information
Configuration notes for Dhcp option
Dhcp option 82 sub-options
Sub-option 6 Subscriber ID
Sub-option 1 Circuit ID
Sub-option 2 Remote ID
Dhcp option 82 configuration
Syntax no dhcp snooping relay information
Syntax ip dhcp relay information policy policy-type
Changing the forwarding policy
Enabling and disabling subscriber ID processing
Viewing the ports on which Dhcp option 82 is disabled
Output for the ip dhcp relay information command
Viewing information about Dhcp option 82 processing
Viewing the circuit ID, remote ID, and forwarding policy
Syntax show interfaces ethernet port
IP source guard
Viewing the status of Dhcp option 82 and the subscriber ID
Page
For ip-addr, enter a valid IP address
No source-guard enable
Defining static IP source bindings
Syntax no source-guard enable
Enabling IP source guard per-port-per-VLAN
Enabling IP source guard on a VE
Displaying learned IP addresses
IP source guard
Broadcast, unknown Unicast, and Multicast rate limiting
Configuration notes and feature limitations
Configuring rate limiting for BUM traffic
Viewing rate limits set on BUM traffic
Syntax show run interface
Syntax show rate-limit broadcast
Broadcast, unknown Unicast, and Multicast rate limiting
Index
ARP
Radius
Page
Page
MAC-VLAN
Page
SSH
Ip access-group,110 mac-vlan-permit,220 source-guard enable
Vlan
