Actions on a Packet and Actions on the Binding Table The distinction between system behaviour in the context of a binding table entry and system behaviour in the context of a packet (from which the binding information is extracted) is an important one, because the available actions are exclusive to each context. SISF actions on a packet determine if any other feature is allowed to access, or use, or forward the packet. • Stop: Means the packet is not available to any client or feature. A packet may be stopped while the binding integrity of a possible entry is being verified.
From a system perspective,this action is equivalent to a packet drop, but from a SISF perspective, this is not necessarily seen as a malicious packet (as in case of drop), as SISF tries to glean the binding information from it. • Forward: Means the packet is allowed to enter the network and is sent on, unchanged. • Drop: Means the packet is not allowed to enter the network. Until Cisco IOS XE Bengaluru 17.6.x, the drop action is restricted to ND Packets. Starting with Cisco IOS XE Cupertino 17.7.1, packet the drop action can occur with ARP Packets also. SISF actions on the binding table include only the following: • Create or update:
Means the packet or other source is used to create or update an entry in the binding table. • Ignore: Means the packet or other source of information is disregarded and there is no change or update in the binding table. Multiple actions may be performed on a packet: If the stop and ignore actions are observed for a packet, it may also result in a drop . If stop and update actions are observed, the packet is allowed to enter the network and is sent on, unchanged. Device-Tracking Policy A device-tracking policy is a set of rules that SISF-based device-tracking follows.
The policy dictates which events will be listened to, whether a host will be probed, the wait time before the host is probed, and so on. These rules are referred to as policy parameters. Note The policy must be attached to an interface or VLAN. Only then is the binding table for that interface or VLAN populated - in accordance with policy parameters. For information about the various ways in which you can create a policy, see How to Configure SISF, on page 20 . To display a policy's settings, use the show device-tracking policy policy_name command in privileged EXEC mode.
Understanding Policy Parameters Policy parameters are the keywords available for configuration in the device-tracking configuration mode. Each policy parameter addresses one or more aspects of network security. Configuring Switch Integrated Security Features Actions on a Packet and Actions on the Binding Table Configuring Switch Integrated Security Features 8