Configuring Switch Integrated Security Features Creating a Custom Device Tracking Policy with Custom Settings Command or Action Purpose • exit—Exits the device-tracking policy configuration mode. • limit address-count—Specifies an address count limit per port. The range is 1 to 32000. • no—Negates the command or sets it to defaults. • (Optional) prefix-glean—Enables learning of prefixes from either IPv6 Router Advertisements or from DHCP-PD. You have the following option: • (Optional) only—Gleans only prefixes and not host addresses. • (Optional) protocol—Sets the protocol to glean; by default, all are gleaned. Enter one of these options: • arp [prefix-list name]:
Gleans addresses in ARP packets. Optionally, enter the name of prefix-list that is to be matched. • dhcp4 [prefix-list name]: Glean addresses in DHCPv4 packets. Optionally, enter the name of prefix-list that is to be matched. • dhcp6 [prefix-list name]: Glean addresses in DHCPv6 packets. Optionally, enter the name of prefix-list that is to be matched. • ndp [prefix-list name]: Glean addresses in NDP packets. Optionally, enter the name of prefix-list that is to be matched. • (Optional) security-level—Specifies the level of security enforced by the feature. Enter one of these options: • glean—Gleans addresses passively. • guard—Inspects and drops un-authorized messages. This is the default.
• inspect—Gleans and validates messages. Configuring Switch Integrated Security Features 24