Table 366: Components of the Port Security Topology
(continued)
Settings
Properties
ge-0/0/8
Interface for DHCP server
In this example, use the MAC limit feature to control the total number of MAC addresses
that can be added to the Ethernet switching table for the specified interface. Use the
allowed MAC addresses feature to ensure that the addresses of network devices whose
network access is critical are guaranteed to be included in the Ethernet switching table.
In this example, the switch has already been configured as follows:
•
Secure port access is activated on the switch.
•
No MAC limit is set on any of the interfaces.
•
All access interfaces are untrusted, which is the default setting.
Configuration
To configure MAC limiting and some allowed MAC addresses to protect the switch against
Ethernet switching table overflow attacks:
CLI Quick
Configuration
To quickly configure MAC limiting and some allowed MAC addresses, copy the following
commands and paste them into the switch terminal window:
[edit ethernet-switching-options secure-access-port]
set interface ge-0/0/1 mac-limit 4 action drop
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:80
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:81
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:83
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:85
Step-by-Step
Procedure
Configure MAC limiting and some allowed MAC addresses:
Configure a MAC limit of
4
on
ge-0/0/1
and specify that incoming packets with
different addresses be dropped once the limit is exceeded on the interface:
1.
[edit ethernet-switching-options secure-access-port]
user@switch#
set interface ge-0/0/1
mac-limit
4 action drop
2.
Configure the allowed MAC addresses on
ge-0/0/2
:
[edit ethernet-switching-options secure-access-port]
user@switch#
set interface ge-0/0/2
allowed-mac
00:05:85:3A:82:80
user@switch#
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:81
user@switch#
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:83
user@switch#
set interface ge-0/0/2 allowed-mac 00:05:85:3A:82:85
Results
Check the results of the configuration:
[edit ethernet-switching-options secure-access-port]
user@switch# show
interface ge-0/0/1.0 {
mac-limit 4 action drop;
}
interface ge-0/0/2.0 {
Copyright © 2010, Juniper Networks, Inc.
2858
Complete Software Guide for Junos
®
OS for EX Series Ethernet Switches, Release 10.3
Summary of Contents for JUNOS OS 10.3 - SOFTWARE
Page 325: ...CHAPTER 17 Operational Mode Commands for System Setup 229 Copyright 2010 Juniper Networks Inc ...
Page 1323: ...CHAPTER 56 Operational Mode Commands for Interfaces 1227 Copyright 2010 Juniper Networks Inc ...
Page 2841: ...CHAPTER 86 Operational Commands for 802 1X 2745 Copyright 2010 Juniper Networks Inc ...
Page 3367: ...CHAPTER 113 Operational Mode Commands for CoS 3271 Copyright 2010 Juniper Networks Inc ...
Page 3435: ...CHAPTER 120 Operational Mode Commands for PoE 3339 Copyright 2010 Juniper Networks Inc ...
Page 3529: ...CHAPTER 126 Operational Mode Commands for MPLS 3433 Copyright 2010 Juniper Networks Inc ...
