At a policy level there are separate limits for the number of IP addresses per port, the number of IPv4 addresses per MAC, and IPv6 addresses per MAC. You can configure or change only the number of IP addresses per port. IP per Port The IP per port option is the total number of IP addresses allowed for a port. The address can be IPv4 or IPv6. When the limit is reached, no further IP addresses (i.e., entries) are added to the binding table. To configure this parameter in a policy, enter the limit address-count ip-per-port keyword in device-tracking configuration mode.
If you configure a limit that is lower than the currently configured one, then the new (lower) limit is applicable only to new entries. An existing entry remains in the binding table and goes through its binding entry lifecycle. IPv4 per MAC and IPv6 per MAC This refers to the number of IPv4 addresses that can be mapped to one MAC address and the number of IPv6 addresses that can be mapped to one MAC address. When the limit is reached, no further entries can be added to the binding table, and traffic from new hosts will be dropped Note The IPv4 per MAC limit and the IPv6 per MAC limit that is effective on an interface or VLAN is as defined in the policy that is applied.
If the policy does not specify a limit, this means that a limit does not exist. You cannot change or configure a limit for IPv4 per MAC or IPv6 per MAC for any kind of policy (programmatic, or custom policy, or default policy). Enter the show device-tracking policy policy name to check if a limit exisits. The following is sample output of a policy where an IPv4 per MAC and an IPv6 per MAC limit exists: Device# show device-tracking policy LISP-DT-GUARD-VLAN Policy LISP-DT-GUARD-VLAN configuration:
security-level guard (*) truncated> limit address-count for IPv4 per mac 4 (*) limit address-count for IPv6 per mac 12 (*) tracking enable truncated> Address Count Limit and SISF Action on the Binding Table The Actions on a Packet and Actions on the Binding Table , on page 8 section clarifies the difference between SISF actions on packet and those on the binding table. The address count limit parameter affects actions that are performed on the binding table: If a limit is reached, binding entries are not added to the binding table. (It does not influence packet action).
Address Count Limit and Interactions with Other SISF Settings • The limits do not have a hierarchy, but the threshold that is set for each limit affects the others. For example, if the IP per port limit is 100, and the IPv4 per MAC limit is one, the limit is reached with a single host’s IPv4-MAC binding entry. No further IP entries, which are bound to the same MAC are allowed in the table even though the port has a provision for 99 more IP addresses. Similarly, if the IP Configuring Switch Integrated Security Features Address Count Limits Configuring Switch Integrated Security Features 18