The following figure shows a simple network topology and a representative binding table for each access switch in the network. SW A and SW B are the two access switches in the network. The two access switches are connected to the same distribution switch. H1, H2, H3, H4 are the hosts. This is an example of a distributed binding table, that is, each access switch in the network has its own table. An alternative set-up could be one centralised binding table on the distribution switch with the entries of SW A and SW B .
Having a distributed or a centralised binding table is a key design choice in the process of implementing SISF in your network and is covered in greater detail in the Understanding Policy Parameters, on page 8 section in this chapter. Figure 2: Binding Table (Click on the image to see the details more clearly.) States and Lifetime of a Binding Table Entry The state of an entry indicates if the host is reachable or not. The stable states of a binding table entry are: REACHABLE, DOWN, and STALE. When changing from one state to another, an entry may have other temporary or transitional states such as: VERIFY, INCOMPLETE, and TENTATIVE.
The duration an entry remains in a given state is determined by its lifetime and whether the entry is successfully validated. The lifetime of an entry can be policy-driven or configured globally, and in case of DHCP-originated entries it is determined based on the DHCP lease time. To configure the REACHABLE, DOWN, and STALE lifetimes, enter the following command in global configuration mode:
device-tracking binding { reachable-lifetime { seconds | infinite } | stale-lifetime { seconds | infinite } | down-lifetime { seconds | infinite } } For DHCP-originated entries, the above configuration does not apply as the DHCP lease time overrides the SISF stale-lifetime and down-lifetime configuration that are globally defined or specified by the policy. Note State: Reachable If an entry has this state, it means the host (IP and MAC address) from which a control packet was received, is a verified and valid host. A reachable entry has a default lifetime of 5 minutes. You can also configure a duration.
By configuring a reachable-lifetime, you specify how long a host can remain in a REACHABLE state, after the last incoming control packet from that host. Configuring Switch Integrated Security Features States and Lifetime of a Binding Table Entry Configuring Switch Integrated Security Features 3