Note While there are scenarios where configuring only either one of these options may be suitable, the more common use case is for both the trusted-port and device-role switch options to be configured on the port - the examples below explain this in detail. Possible scenarios where only either one of these options is suited or required have also been described, at the end of this section. To configure these parameters in a policy, enter the trusted-port and device-role keywords in the device-tracking configuration mode. Example:
Using Trusted-Port and Device-Role Switch Options in a Multi-Switch Set-Up The following example explains how the device-role switch and trusted-port options help to design an efficient and scalable “secure zone”. In figure " Multi-Switch Set-Ups Without Trusted-Port and Device-Role Switch Options " below, SW A , SW B , and SW C are three access switches. They are all connected to a common distribution switch. The only required configuration on the distribution switch in this scenario is to ensure that traffic of any kind is not blocked. H1, H2, …H6 are the hosts. Each switch has two directly connected hosts.
All hosts are communicating with each other, that is, control packets are being transmitted. All hosts are also within the same VLAN boundary. Each switch is receiving control packets from hosts that are directly connected to it, and also from hosts that are connected to other switches. This means SW A is receiving control packets from H1, H2, …H6 similarly with SW B and SW C . For each switch, the entries of directly connected hosts have interface or port P 1 and P 2 in the binding table.
Entries originating from hosts that are connected to other switches have interface or port name P x UP, to show that they have been learned through the uplink port (x represents the corresponding uplink port for each switch. For example, the entries that SW A has learnt through its uplink port have interface or port name P A UP and for SW B it is P B UP, and so forth. The end result is that each switch learns and creates binding entries for all hosts in the set-up. This scenario displays an inefficient use of the binding table, because each host is being validated multiple times, which does not make it more secure than if just one switch validates host.
Secondly, entries for the same host in multiple binding tables could mean that the address count limit is reached sooner. After the limit is reached, any further entries are rejected and required entries may be missed this way. Configuring Switch Integrated Security Features Trusted-Port and Device-Role Switch Configuring Switch Integrated Security Features 11