Example:ConfiguringaMulti-SwitchNetworktoStopCreatingBindingEntries from a Trunk Port In a multi-switch network, SISF-based device tracking provides the capability to distribute binding table entries between switches running the feature. Binding entries are only created on the switches where the host appears on an access port. No entry is created for a host that appears over a trunk port. This is achieved by configuring a policy with the trusted-port and device-role switch options, and attaching it to the trunk port. Note Both, the trusted-port , and device-role switch options, must be configured in the policy.
Further, we recommended that you apply such a policy on a port facing a device, which also has SISF-based device tracking enabled. Device> enable Device# configure terminal Device(config)# device-tracking policy example_trusted_policy Device(config-device-tracking)# device-role switch Device(config-device-tracking)# trusted-port Device(config-device-tracking)# exit Device(config)# interface gigabitethernet 1/0/25 Device(config-if)# device-tracking attach-policy example_trusted_policy Device(config-if)# end Example: Avoiding a Short Device-Tracking Binding Reachable Time When migrating from an older release, the following configuration may be present:
device-tracking binding reachable-lifetime 10 Remove this by entering the no version of the command. Device> enable Device# configure terminal Device(config)# no device-tracking binding reachable-lifetime 10 Device(config)# end Example: Detecting and Preventing Spoofing Address spoofing, is a man-in-the-middle attack that allows an attacker to intercept communication between network devices. These attacks attempt to divert traffic from its originally intended host to the attacker instead.
For example, attacks are carried out by sending unsolicited Address Resolution Protocol (ARP) replies or with IPv6 Neighbor Advertisements carrying a mapping that is different from the legitimate one, such as . When the IPTARGET is of the default gateway, all traffic that is meant to leave the subnet is routed to the attacker. The following example shows shows the required SISF configuration to enable the system to detect and prevent spoofing. It also shows the system messages that are logged when spoofing is detected, and the action that the system takes. It includes an excerpt of LISP configuration in an SDA setup for example purposes only.
Actual LISP configuration may involve additional configuration. Sample LISP configuration: Configuring Switch Integrated Security Features Example: Configuring a Multi-Switch Network to Stop Creating Binding Entries from a Trunk Port Configuring Switch Integrated Security Features 36