Using Port Security

​Syntax

​

Show port-security command displaying eavesdrop prevention

​

Networking switches support DHCPv4 and DHCPv6 snooping. Configuring both versions helps protect your entire network configuration by blocking unintended or rogue DHCPv4 and DHCPv6 servers.

​

Configuring DHCPv4 snooping

​

Enabling DHCPv4 snooping

To globally enable DHCPv4 snooping, enter :

​

switch(config)# dhcp-snooping

Use the no form of the command to disable DHCPv4 snooping.

​

Configuring DHCPv4 snooping

​Syntax

​

[no]​dhcp-snooping [authorized-server | database | option | trust | verify | vlan]

​​

​

​ ​authorized server	Specifies the IP address of a trusted DHCP server. If no authorized servers are configured, all DHCP server addresses are considered valid. Maximum: 20 authorized servers.
​ ​database	Specifies a URL location for the lease database in the format tftp://ip-addr/ascii-string. The maximum number of characters for the URL is 63.
​ ​option	Adds the relay information option (Option 82) to DHCP client packets that are being forwarded out trusted ports. The default is yes, add relay information.
​ ​trust	Configures trusted ports. Only server packets received on trusted ports are forwarded. Default: untrusted.
​ ​verify	Enables DHCP packet validation. The DHCP client hardware address field and the source MAC address must be the same for packets received on untrusted ports or the packet is dropped. Default: Yes.
​ ​vlan	Enables DHCP snooping on a vlan. DHCP snooping must be enabled already. Default: No.

To display the DHCPv4 snooping configuration, enter this command:

switch(config)# show dhcp-snooping

The following figure shows sample output.

​

Show dhcpv4-snooping

​

To display statistics about the DHCPv4 snooping process, enter this command:

switch(config)# show dhcp-snooping stats

The following figure shows sample output.

​

Show DHCPv4 snooping statistics

​

​

Enabling DHCPv4 snooping on VLANs

DHCPv4 snooping on VLANs is disabled by default. To enable DHCP snooping on a VLAN or range of VLANs enter this command:

switch(config)# dhcp-snooping vlan <vlan-id-range>

You can also use this command in the vlan context, in which case you cannot enter a range of VLANs for snooping. Below is an example of DHCP snooping enabled on VLAN 4.

​

DHCP snooping on a VLAN

​

​

Using DHCPv4 snooping with option 82

DHCPv4 adds Option 82 (relay information option) to DHCPv4 request packets received on untrusted ports by default. (See “Configuring DHCP Relay” in the management and configuration guide for more information on Option 82.)

When DHCPv4 is enabled globally and also enabled on a VLAN, and the switch is acting as a DHCPv4 relay, the settings for the DHCPv4 relay Option 82 command are ignored when snooping is controlling Option 82 insertion. Option 82 inserted in this manner allows the association of the client’s lease with the correct port, even when another device is acting as a DHCPv4 relay or when the server is on the same subnet as the client.

	NOTE: DHCPv4 snooping only overrides the Option 82 settings on a VLAN that has snooping enabled, not on VLANs without snooping enabled.

If DHCPv4 snooping is enabled on a switch where an edge switch is also using DHCPv4 snooping, it is desirable to have the packets forwarded so the DHCPv4 bindings are learned. To configure the policy for DHCPv4 packets from untrusted ports that already have Option 82 present, enter this command in the global configuration context.

​Syntax

​

[no]​dhcp-snooping option 82 [remote-id <mac|subnet-ip|mgmt-ip>][untrusted-policy<drop|keep|replace>]

​​

Enables DHCP Option 82 insertion in the packet

​

​ ​remote-id

Sets the value used for the remote-id field of the relay information option. mac Uses the switch mac address for the remote-id. This is the default. subnet-ip Uses the IP address of the VLAN on which the packet was received for the remote-id. If subnet-ip is specified but the value is not set, the MAC address is used. mgmt-ip Uses the management VLAN IP address as the remote-id. If mgmt-ip is specified but the value is not set, the MAC address is used.

​ ​untrusted-policy

Configures DHCPv4 snooping behavior when forwarding a DHCPv4 packet from an untrusted port that already contains DHCPv4 relay information (Option 82). The default is drop. drop Drops the packet. keep Forwards the packet without replacing the option information. replace Replaces the existing option with a new Option 82 generated by the switch. NOTE: The default drop policy should remain in effect if there are any untrusted nodes, such as clients, directly connected to this switch.

​

Changing the DHCPv4 remote-id from a MAC to an IP address

By default, DHCPv4 snooping uses the MAC address of the switch as the remoteid in Option 82 additions. The IP address of the VLAN the packet was received on or the IP address of the management VLAN can be used instead by entering this command with the associated parameter:

switch(config)# dhcp-snooping option 82 remote-id <mac|subnet-ip|mgmt-ip>

​

DHCPv4 snooping option 82 using the VLAN IP address

​

Disabling the DHCPv4 MAC address check

DHCPv4 snooping drops DHCPv4 packets received on untrusted ports when the check address (chaddr) field in the DHCPv4 header does not match the source MAC address of the packet (default behavior). To disable this checking, use the no form of this command.

switch(config)# dhcp-snooping verify mac

​

Showing the DHCPv4 snooping verify MAC setting

​

Setting the DHCPv4 binding database location

DHCPv4 snooping maintains a database of up to 8192 DHCP bindings on untrusted ports. Each binding consists of:

• Client MAC address

• Port number

• VLAN identifier

• Leased IP address

• Lease time

You can configure the switch to store the bindings at a specific URL so they are not lost if the switch is rebooted. If the switch is rebooted, it reads its binding database from the specified location. To configure this location use this command.

​Syntax

​

[no]​dhcp-snooping database [file<tftp://<ip-address>/<ascii-string>>][delay<15-86400>][timeout<0-86400>]

​​

​

​ ​file	Specifies a file in Uniform Resource Locator (URL) format — “tftp://ip-address/ascii-string”. The maximum filename length is 63 characters.
​ ​delay	Specifies the number of seconds to wait before writing to the database. Default = 300 seconds.
​ ​timeout	Specifies the number of seconds to wait for the database file transfer to finish before returning an error. A value of zero (0) means retry indefinitely. Default = 300 seconds.

A message is logged in the system event log if the DHCP binding database fails to update. To display the contents of the DHCP snooping binding database, enter this command.

​Syntax

​show dhcp-snooping binding

​​

​

Showing DHCPv4 snooping binding database contents

​

	NOTE: If a lease database is configured, the switch drops all DHCPv4 packets until the lease database is read. This only occurs when the switch reboots and is completed quickly. If the switch is unable to read the lease database from the tftp server, it waits until that operation times out and then begins forwarding DHCP packets.

​

DHCPv4 Snooping Max Binding

​​

DHCPv4 snooping max-binding prevents binding entries from getting exhausted. This feature is on a per-port basis. It restricts the maximum number of bindings allowed on a port/interface. It applies to untrusted interfaces only. The maximum bindings for a particular port includes both statically configured and dynamically learned. The number of bindings on a per port basis is maintained i.e., incremented upon a lease offer and decremented upon a lease expiry or release.

DHCPv4 snooping max-binding can be configured in configuration context or in an interface context for an untrusted interface. In case of configuration context, a port or a list of ports is selected for which max-binding is to be configured. Then the corresponding max-binding value is provided within a range of <1-8192>. For the interface context, after selecting the interface on which max-binding is to be configured, the max-binding value is provided within a range of <1-8192>. The max-binding configuration for a port can be removed using the no option of the command. max-binding cannot be set on trusted ports and ports for which the associated VLAN is not DHCP-snooping enabled. Once the max-bindings limit on an interface is reached, packets for DHCP clients which do not have a binding entry are dropped.

​Syntax

​

​(config)# dhcp-snooping max-bindings [PORT-LIST][MAX-BINDING-NUM]

​​

Configure the maximum number of bindings on specified ports. The maximum number of bindings default value is 8192. The allowed range on a port is 1 to 8192.

​Syntax

​

​(interface)# dhcp-snooping <trust|max-bindings>[1-8192]

​​

Configures the maximum binding value on a port. Only this number of clients are allowed on a port. By specifying [no] the max-binding is removed from the configuration and set to the default value of 8192.

​Syntax

​

​(config)# show dhcp-snooping

​​

Shows all available dhcpv4-snooping information.

​Example​

DHCP Snooping Information
DHCP Snooping : Yes
                Max       Current  Bindings
Port   Trust    Bindings  Static   Dynamic
_____  ______   ________  _______  _________
 1     Yes         -         -       -
 2     No         200        10      3
 3     No          3*        3       6
 4     No          5*        23      0
 5     No          -         -       -
 6     No          -         -       -
 7     No          -         -       -
 8     No          -         -       -
 9     No          -         -       -
 10    No          -         -       -
 11    Yes         -         -       -
 12    Yes         -         -       -
 13    No          -         -       -
 14    No          -         -       -
 15    No          -         -       -
 16    No          -         2       8
 17    No          21       12      24
 18    Yes         -         -       -
 19    No          -         -       -
 20    No          -         -       -
 21    No          -         -       -
 22    No          -         -       -
 23    No          -         -       -
 24    Yes         -         -       -

​Syntax

​

​(config)# show dhcp-snooping stats

​​

Shows the dhcpv4 -snooping statistics.

​

Packet type  Action   Reason                        Count
 -----------  -------  ----------------------------  ---------
server       forward  from trusted port              0
client       forward  to trusted port                0
server       drop     received on untrusted port     0
server       drop     unauthorized server            0
client       drop     destination on untrusted port  0
client       drop     untrusted option 82 field      0
client       drop     bad DHCP release request       0
client       drop     failed verify MAC check        0
client       drop     failed on max-binding limit    0

​

Enabling DHCPv4 debug logging

To enable debug logging for DHCPv4 snooping, use this command.

​Syntax

​

[no]​debug security dhcp-snooping [agent | event | packet]

​​

​

​ ​agent	Displays DHCP snooping agent messages.
​ ​event	Displays DHCP snooping event messages.
​ ​packet	Displays DHCP snooping packet messages.

switch(config)# dhcpv6-snooping

To enable dynamic ARP protection for VLAN traffic on a routing switch, enter the arp-protect vlan command at the global configuration level.

​Syntax

To remove an address learned using either of the preceding methods, do one of the following:

This command option removes unwanted devices (MAC addresses) from the Authorized Addresses list. An Authorized Address list is available for each port for which Learn Mode is currently set to "Static". See the command syntax listing under Configuring port security.

	CAUTION: When learn mode is set to static, the Address Limit (address-limit) parameter controls how many devices are allowed in the Authorized Addresses (mac-address) for a given port. If you remove a MAC address from the Authorized Addresses list without also reducing the Address Limit by 1, the port may subsequently detect and accept as authorized a MAC address that you do not intend to include in your Authorized Address list. Thus, if you use the CLI to remove a device that is no longer authorized, it is recommended that you first reduce the Address Limit (address-limit) integer by 1, as shown below. This prevents the possibility of the same device or another unauthorized device on the network from automatically being accepted as "authorized" for that port.

To remove a device (MAC address) from the "Authorized" list and when the current number of devices equals the Address Limit value, you should first reduce the Address Limit value by 1, then remove the unwanted device.

	NOTE: You can reduce the address limit below the number of currently authorized addresses on a port. This enables you to subsequently remove a device from the "Authorized" list without opening the possibility for an unwanted device to automatically become authorized.

​Example

Suppose port A1 is configured as shown below and you want to remove 0c0090-123456 from the Authorized Address list:

​

Two authorized addresses on port A1

​

The following command serves this purpose by removing 0c0090-123456 and reducing the Address Limit to 1:

switch(config)# port-security a1 address-limit 1

switch(config)# no port-security a1 mac-address

0c0090-123456

The above command sequence results in the following configuration for port A1:

​

Port A1 after removing one MAC address

​

switch(config)# port-security a1 learn-mode static action send-disable

switch(config)# port-security a1 learn-mode static mac-address
0c0090-123456 action send-disable

switch(config)# port-security a5 learn-mode static address-limit
2 mac-address 00c100-7fec00 0060b0-889e00 action send-alarm

The following options allow learned MAC addresses to be removed from the MAC address table as follows:

This functionality is also supported by SNMP.

​

Configuring Clearing of Learned MAC Addresses

Use the following commands to clear learned MAC addresses from a port or list of ports, a specific VLAN, or to clear a specific MAC address from a VLAN.

​Syntax 

clear mac-address port <port-list>

​

Removes MAC addresses that were learned on the specified port or ports in <port-list> . Use all to remove all MAC addresses in the MAC address table.

​

switch(config)# clear mac-address port 4-7

​Syntax 

clear mac-address vlan <vid>

​

Removes all MAC addresses that were learned on the specified VLAN.

​

switch(config)# clear mac-address vlan 2

​Syntax 

clear mac-address vlan <vid> mac<mac-addr>

​

Removes the specified MAC address from the specified VLAN

​

switch(config)# clear mac-address vlan 2 mac 0001e6-b197a8

To view the results from clearing a MAC address, use the show mac-address command with the appropriate option.

​

A MAC Address cleared from the MAC Address Table

​

When deploying MAC Lockdown, it is crucial to consider its use in your network topology to ensure security. If using techniques such as meshing or Spanning Tree Protocol (STP) to speed up network performance by providing multiple paths for devices, using MAC Lockdown either will not work or may defeat the purpose of having multiple data paths.

Using MAC Lockdown to prevent a malicious user from hijacking an approved MAC address to steal data traffic sent to that address. The MAC lockdown feature (static‐mac) allows administrators to configure the authorized set of clients on a given port.

MAC Lockdown helps prevent hijacking by ensuring that all traffic to a specific MAC address goes only to the correct port on a switch, which must be connected to the real device bearing that MAC address.

However, incorrectly deploying MAC Lockdown in a network that uses multiple path technology, Spanning Tree or mesh networks can cause errors.

Let’s examine a good use of MAC Lockdown within a network to ensure security first.

A routing switch maintains a DHCP binding database, which is used for DHCP and ARP packet validation. Both the DHCP snooping and DHCP Option 82 insertion features maintain the lease database by learning the IP-to-MAC bindings on untrusted ports. Each binding consists of the client MAC address, port number, VLAN identifier, leased IP address, and lease time.

If your network does not use DHCP or if some network devices have fixed, user-configured IP addresses, you can enter static IP-to-MAC address bindings in the DHCP binding database. The switch uses manually configured static bindings for DHCP snooping and dynamic ARP protection.

​

Adding a static binding

To add the static configuration of an IP-to-MAC binding for a port to the database, enter the ip source-binding or ipv6 source-binding command at the global configuration level. Use the noform of the command to remove the IP-to-MAC binding from the database.

​

For IPv4

​Syntax

​

[no]​ip source-binding <mac-address> vlan <vlan-id><ip-address>interface <port-number>

​​

​

​ ​mac-address	Specifies a MAC address to bind with a VLAN and IP address on the specified port in the DHCP binding database.
​ ​vlan-id	Specifies a VLAN ID number to bind with the specified MAC and IP addresses on the specified port in the DHCP binding database.
​ ​ip-address	Specifies an IP address to bind with a VLAN and MAC address on the specified port in the DHCP binding database.
​ ​<port-number>	Specifies the port number on which the IP-to- MAC address and VLAN binding is configured in the DHCP binding database.

An example of the ip source-binding command is shown here:

​

switch(config)# ip source-binding 0030c1-7f49c0
interface vlan 100 10.10.20.1 interface A4

	NOTE: The ip source-binding command is the same command used by the Dynamic IP Lockdown feature to configure static bindings. The Dynamic ARP Protection and Dynamic IP Lockdown features share a common list of source IP-to-MAC bindings.

​

For IPv6

​Syntax

​

[no]​ipv6 source-binding <mac-address> vlan <vlan-id><ip-address>interface <port-number>

​

​ ​mac-address	Specifies a MAC address to bind with a VLAN and IP address on the specified port in the DHCP binding database.
​ ​vlan-id	Specifies a VLAN ID number to bind with the specified MAC and IP addresses on the specified port in the DHCP binding database.
​ ​ip-address	Specifies an IPv6 address to bind with a VLAN and MAC address on the specified port in the DHCP binding database.
​ ​<port-number>	Specifies the port number on which the IP-to- MAC address and VLAN binding is configured in the DHCP binding database.

​

Debugging dynamic IP lockdown

To enable the debugging of packets dropped by dynamic IP lockdown, enter the debug dynamic-ip-lockdown command.

​Syntax

​

​debug dynamic-ip-lockdown

​

To send command output to the active CLI session, enter the debug destination session command.

Counters for denied packets are displayed in the debug dynamic-ip-lockdown command output. Packet counts are updated every five minutes. An example of the command output is shown in Debug dynamic-ip-lockdown command output.

When dynamic IP lockdown drops IP packets in VLAN traffic that do not contain a known source IP-to-MAC address binding for the port on which the packets are received, a message is entered in the event log.

​

Debug dynamic-ip-lockdown command output

​

To display the ports on which dynamic IP lockdown is configured, enter the show ip source-lockdown status or show ipv6 source-lockdown status command at the global configuration level.

​

For IPv4

​Syntax

​

​show ip source-lockdown status

​​

Output for the show ip source-lockdown status command is shown in the following example.

​

show ip source-lockdown status command output

​

To simply add a device (MAC address) to a port's existing Authorized Addresses list, enter the port number with the mac-address parameter and the device's MAC address.This assumes that Learn Mode is set to static and the Authorized Addresses list is not full (as determined by the current Address Limit value).

​Example

Suppose port A1 allows two authorized devices, but has only one device in its Authorized Address list:

​

Adding an authorized device to a port

​

With the above configuration for port A1, the following command adds the 0c0090-456456 MAC address as the second authorized address.

switch(config)# port-security a1 mac-address 0c0090-456456

After executing the above command, the security configuration for port A1 would be:

​

Adding a second authorized device to a port

​

The message Inconsistent value appears if the new MAC address exceeds the current Address Limit or specifies a device that is already on the list. Note that if you change a port from static to continuous learn mode, the port retains in memory any authorized addresses it had while in static mode. If you subsequently attempt to convert the port back to static mode with the same authorized addresses, the Inconsistent value message appears because the port already has the addresses in its "Authorized" list.

If adding a device (MAC address) to a port on which the Authorized Addresses list is already full (as controlled by the port’s current Address Limit setting), then increase the Address Limit in order to add the device, even if replacing one device with another. Using the CLI, you can simultaneously increase the limit and add the MAC address with a single command.

For example, suppose port A1 allows one authorized device and already has a device listed:

​

Port security on port A1 with an address limit of "1"

​

To add a second authorized device to port A1, execute a port-security command for port A1 that raises the address limit to 2 and specifies the additional device's MAC address. For example:

switch(config)# port-security a1 mac-address 0c0090-456456 address-limit 2

The following commands display port status, including whether there are intrusion alerts for any ports, list the last 20 intrusions, and either reset the alert flag on all ports or for a specific port for which an intrusion was detected. The record of the intrusion remains in the log. For more information, see Operating notes for port security.

​Syntax

​Example

In the following example, executing show interfaces brief lists the switch port status, indicating an intrusion alert on port A1.

​

An unacknowledged intrusion alert in a port status display

​

To see the details of the intrusion, enter the show port-security intrusion-log command. For example:

​

The intrusion log with multiple entries for the same port

​

The above example shows three intrusions for port A1. Since the switch can show only one uncleared intrusion per port, the older two intrusions in this example have already been cleared by earlier use of the clear intrusion-log or the port-security <port-list> clear-intrusion-flag command. The intrusion log holds up to 20 intrusion records, and deletes intrusion records only when the log becomes full and new intrusions are subsequently added. The "prior to​" text in the record for the third intrusion means that a switch reset occurred at the indicated time and that the intrusion occurred prior to the reset.

To clear the intrusion from port A1 and enable the switch to enter any subsequent intrusion for port A1 in the Intrusion Log, execute the port-security clear-intrusion-flag command. If you then re-display the port status screen, you see that the Intrusion Alert entry for port A1 is changed to "No". (Executing show port-security intrusion-log again results in the same display as above, and does not include the Intrusion Alert status.)

switch(config)# port-security a1 clear-intrusion-flag

switch(config)# show interfaces brief

​

Port status screen after alert flags reset

​

For more on clearing intrusions, see Keeping the intrusion log current by resetting alert flags.

The menu interface indicates per-port intrusions in the Port Status screen, and provides details and the reset function in the Intrusion Log screen.

If you then re-display the port status screen, you see that the Intrusion Alert entry for port A3 is changed to "No". That is, your evidence that the Intrusion Alert flag has been acknowledged (reset) is that the Intrusion Alert column in the port status display no longer shows "Yes" for the port on which the intrusion occurred (port A3 in this example). (Because the Intrusion Log provides a history of the last 20 intrusions detected by the switch, resetting the alert flags does not change its content. Thus, displaying the Intrusion Log again results in the same display as in The intrusion log display.

​​​The Event Log lists port security intrusions as:

where "W" is the severity level of the log entry and FFI is the system module that generated the entry. For further information, display the Intrusion Log, as shown below.

From the Manager or Configuration level:

​Syntax

​Example

​

Log listing with and without detected security violations

​

For more Event Log information, see "Using the Event Log To Identify Problem Sources" in the management and configuration guide for your switch.

In the Main Menu, click on 4. Event Log and useNext page and Prev page to review the Event Log contents.

For more Event Log information, see "Using the Event Log To Identify Problem Sources" in the management and configuration guide for your switch.