Figure 6: Multi-Switch Set-Ups Without Trusted-Port and Device-Role Switch Options By contrast, see figure "Multi-Switch Set-Ups With Trusted-Port and Device-Role Switch Options" below. Here, when SW A intercepts the packet of a host that is not attached to it (say H3 which is directly attached to SW B ), it does not create an entry because it detects that H3 is attached to a device that is configured as a switch ( device-role switch option) and the uplink port of the switch (where the packet came from) is a trusted port ( trusted-port option).
By creating binding entries only on switches where the host appears on an access port (port P 1 and P 2 of each switch), and not creating entries for a host that appears over an uplink port or trusted port (P x UP), each switch in the set-up validates and makes only the required entries, thus achieving an efficient distribution of the creation of binding table entries. A second advantage of configuring device-role switch and trusted-port options in a multi-switch scenario is that it prevents duplicate entries when a host, say H1 moves from one switch to another. H1’s IP and MAC binding in the earlier location (let’s say SW A ) continues to remain there until it reaches the STALE state.
But if H1 moves and connects to a second switch, say SW C , then SW A receives a duplicate binding entry through the uplink port. In such a situation, if the uplink port of the second switch (SW C ) is configured as a trusted port, SW A deletes its stale entry. Further, it doesn’t create another new binding entry because the SW C will already have the latest entry and this entry is trusted. Configuring Switch Integrated Security Features Trusted-Port and Device-Role Switch Configuring Switch Integrated Security Features 12