41-5
be recorded in the DHCP-snooping table. Consequently, this client cannot pass the IP
DHCP-snooping table, thus it cannot access external networks.
To s
bind
, and the port connecting to the client, so that
pack
IP-to-
If m
clien
To e
auth
ith the authenticated 802.1x client-based IP filtering function enabled, the switch can
co
IP filt
filtering can be implemented based on the DHCP-snooping table, IP static binding table, or
IP-to-MAC mappings of authenticated 802.1x clients, according to actual network requirements. The
Filtering packets based on their source IP addresses. If the source IP address in a packet and the
number of the port that receives the packet match an entry or mapping, the switch regards the
s a valid packet and forwards it; otherwise, the switch drops it directly.
z
Filtering packets based on their source IP and MAC addresses. If the source IP address and
g, the switch regards the packet as a valid packet and forwards it; otherwise, the
switch drops it directly.
Filtering packets based on their source IP and MAC addresses, and traffic limit defined in a QoS
r security filtering
Conf
Config
Follo
snooping:
client cannot
filtering of the
olve this problem, the switch supports the configuration of static binding table entries, that is, the
ing relationship between IP address, MAC address
ets of the client can be correctly forwarded.
MAC mappings of authenticated 802.1x clients
ost clients are assigned with static IP addresses, you need to configure an IP static binding for each
t. The configuration is a heavy workload and causes errors easily.
nsure security, in actual networks, clients are usually connected to networks through 802.1x
entication. W
re
rd and query the IP-to-MAC mappings of authenticated 802.1x clients to defend against IP attacks.
ering
IP
switch can filter IP packets in the following modes:
z
packet a
source MAC address in the packet, and the number of the port that receives the packet match an
entry or mappin
z
profile. You can associate IP filtering with the traffic limit function on the switch fo
and precise packet limit.
iguring DHCP Snooping
uring DHCP Snooping
w these steps to configure DHCP
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enable DHCP snooping
dhcp-snooping
Required
By default, the DHCP snooping
function is disabled.
Enter Ethernet port view
interface interface-type
interface-number
—
Specify the current
trusted port
port as a
g trust
Required
efault, after DHCP
oping is enabled, all ports of
e untrusted ports.
dhcp-snoopin
By d
sno
a switch ar
