Home
Главная
АМАТЕК
Коммутаторы
AN-SGM28P24-400
Руководство по интерфейсу командной строки CLI Страница: 75

АМАТЕК AN-SGM28P24-400 [75/322] Brief introduction

74 / 322

5.1 brief introduction

Configuring IP and MAC binding on Layer 2 switch ports is a static defense against ARP

attacks。ARP attackers attack MAC users by sending ARP messages with false MAC addresses,

which causes the local ARP cache table to be covered by the attacker's address, so that the normal

data flows to the attacker。In the switch port configuration command static binding user IP address

and MAC address can effectively filter ARP attack packets。

In addition to anti-ARP spoofing function, IP MAC binding function can protect the IP and

MAC one by one mapping relationship, that is an IP can only correspond to a MAC, a MAC can

only correspond to an IP, if then The incoming device modifies this mapping, and it will not be

able to communicate in this network。802.1x anti ARP spoofing function and DHCP SNOOPING

protocol are the dynamic implementation of this function。

The four functions of IP MAC binding, ACL, 802.1x anti ARP spoofing and DHCP

SNOOPING all use the same system resource CFP, and pay attention to whether the resources of

CFP are exhausted when configuring。We have developed a compatibility relationship between

them in the design。Following table：

IP MAC

binding

ACL 802.1x DHCP SNOOPING

IP MAC binding

compatible

Incompatible

compatible

ACL

Incompatible

compatible

Incompatible

802.1x

compatible

Incompatible

compatible

Incompatible

DHCP

SNOOPING

compatible Incompatible Incompatible compatible

CFP is a limited hardware resource, the average to each port can only be configured 16 IP

MAC binding entries, so in a network access to a host if only a few ports or a small number of IP

and MAC addresses need to be controlled, you can use static The IP MAC binding function。

Avoiding CFP function exhaustion leads to data forwarding failure。

In addition, as for the use of 802.1x or DHCP SNOOPING protocol, depending on the

current situation, if you use a static IP address configuration and use the 802.1x protocol to access

the network to use 801.1x anti-ARP spoofing can be effective, if the use of dynamic access to IP

address , Use the DHCP SNOOPING protocol。

5.2 IP and MAC binding configurations

IP binds to MAC in the interface mode configuration

Configuring port IP and MAC bindingSwitch#configure terminal

Switch(config)#interface ge1/1

Switch(config-ge1/1)#ip mac-bind A.B.C.D MAC

Delete port IP and MAC binding

Switch#configure terminal

Switch(config)#interface ge1/1

Switch(config-ge1/1)#no ip mac-bind A.B.C.D MAC

АМАТЕК AN-SGM28P24-400 [75/322] Brief introduction

Содержание

Похожие устройства