Figure 11: Secure Zone 3: Efficient Secure Zone When Binding Table is Centralized When to Use Only Trusted-Port or Only Device-Role Switch Configuring only device-role switch is suited to situations when you want to listen but not learn entries. For example, for Duplicate Address Detection (DAD), or when you want to send IPv6 or Neighbor Solicitation (NS) message on a switch-facing port. When you configure this option on a switch port (or interface), SISF-based device-tracking treats the port as a trunk port, implying that the port is connected to other switches. It does not matter whether the port is actually a trunk port or not.
Therefore, when NS packets or queries are sent to switches in the network for new entry validation, only the secure ports (ports where the device-role switch is configured) receive the packet or query. This safeguards the network. If the command is not configured on any port, a general broadcast of the query is sent. Configuring only trusted-port is suited to situations where an access port should be configured as a trusted port. If an access port is connected to a DHCP server or a similar service that the switch is consuming, configuring an access port as a trusted port ensures that the service is not disrupted because traffic from such a port is trusted.
This also widens the secure zone, to include the access port. Address Count Limits The address count limit parameter specifies limits for the number of IP and MAC addresses that can be entered in a binding table. The purpose of these limits is to contain the size of the binding table based on the number of known and expected hosts, thus enabling you to take pre-emptive action against rogue hosts or IPs in the network. Configuring Switch Integrated Security Features When to Use Only Trusted-Port or Only Device-Role Switch Configuring Switch Integrated Security Features 17