If a binding entry is added or updated, the corresponding client is granted access to the network. If an entry does not pass verification, the corresponding client is rejected. The verification process affects the binding entry and the corresponding incoming packet. Note Starting with Cisco IOS XE Cupertino 17.7.1 , the guard security-level supports the prevention of IPv4 spoofing. Detection and reporting of IPv4 spoofing is supported since the introductory release of SISF. Further, detection, reporting, and prevention of IPv6 spoofing is supported since the introductory release of SISF. For more information, see: Example: Detecting and Preventing Spoofing, on page 36 .
Inspect Even though security-level inspect is available on the CLI, we recommend not using it. The glean and guard options described above address most use cases and network requirements. Security Level and SISF Action on a Packet The Actions on a Packet and Actions on the Binding Table , on page 8 section clarifies the difference between SISF actions on packet and those on the binding table. The security level policy parameter can affect actions on ND and ARP packets: If the security level is guard and the packet doesn’t pass verification, a drop action follows. If its glean, the packet is not dropped.
Verification failure (with the guard security level) can be because of various reasons including invalid binding information, reaching the address count limit, and so on. Note that if the packet is an ARP packet, the drop action itself is not possible until Cisco IOS XE Cupertino 17.7.1. Trusted-Port and Device-Role Switch The device-role switch and trusted-port options help you design an efficient and scalable secure zone. When used together, these two parameters help you achieve an efficient distribution of the creation of entries in the binding table. This keeps the binding tables size under control. The trusted-port option: Disables the guard function on configured targets.
Bindings learned through a trusted-port have preference over bindings learned through any other port. A trusted port is also given preference in case of a collision while making an entry in the table. The device-role option: Indicates the type of device that is facing the port and this can be a node or a switch. To allow the creation of binding entries for a port, you configure the device as a node. To stop the creation of binding entries, you configure the device as switch. Configuring the device as a switch is suited to multi-switch set-ups, where the possibility of large device tracking tables is very high.
Here, a port facing a device (an uplink trunk port) can be configured to stop creating binding entries, and the traffic arriving at such a port can be trusted, because the switch on the other side of the trunk port will have device-tracking enabled and that will have checked the validity of the binding entry. Configuring Switch Integrated Security Features Trusted-Port and Device-Role Switch Configuring Switch Integrated Security Features 10