Cambium Networks cnMatrix EX2010-P Handleiding (320 Pagina's)

Handleiding

/ 320

Je bekijkt pagina 155 van 320

L2 Features 155

l

The DAI feature is limited to the number of VLANs in the system.

l

Number of entries in the binding database.

l

The DAI featureper port-channel interfaces is supported from version 4.3.

Default Values

l

The DAI feature is disabled on all VLANs.

l

The DAI trust stateis set as untrusted on all the physical interfaces.

l

The DAI feature does not perform any validation checks.

Prerequisites

l

In order for the DAI validation process to be initiated, the DAI has to be enabled on the VLAN on

which the DAI is required to validate the ARP packets. DAI associates a trust state with each

interface on the switch. ARP response packets received on trusted interfaces will skip the DAI

validation process, and those arriving on untrusted interfaces will be subject to the DAI validation

checks. In a typical network configuration, you configure all switch ports connected to host ports

as untrusted and configure all switch ports connected to switches or servers as trusted. With this

configuration, all ARP packets entering the network from a given switch or server by-pass all the

DAI security check. Although, the trust state must be used with caution since configuring an

interface to be trusted when it is actually untrusted could impact the security of a network.

l

The validity of ARP response packets arriving on the untrusted interfaces of the switch is

determined by comparing the sender’s hardware (MAC) - protocol (IP) addresses pair from each

ARP packet against each MAC address – IP address binding stored in a trusted database from the

switch. This trusted database is called the binding table and it can be populated dynamically when

DHCP packets are exchanged between the switch and the DHCP server or statically, users being

able to manually add entries in this binding table.

Note

In order to populate the IP binding table dynamically, the DHCP Snooping module has to be

enabled globally after enabling the DAI module ona previously createdVLAN.

/ 320

Bekijk gratis de handleiding van Cambium Networks cnMatrix EX2010-P, stel vragen en lees de antwoorden op veelvoorkomende problemen, of gebruik onze assistent om sneller informatie in de handleiding te vinden of uitleg te krijgen over specifieke functies.