instance-id 100 service ethernet eid-table vlan 100 triggers creation of programmatic policy “LISP-DT-GUARD-VLAN” database-mapping mac locator-set XTR11 exit-service-ethernet ! exit-instance-id Settings of the programmatic policy: Device# show device-tracking policy LISP-DT-GUARD-VLAN Device-tracking policy LISP-DT-GUARD-VLAN configuration:
security-level guard enables the detection and prevention of IPv4 and IPv6 spoofing device-role node gleaning from Neighbor Discovery gleaning from DHCP gleaning from ARP gleaning from DHCP4 NOT gleaning from protocol unkn limit address-count for IPv4 per mac 21 limit address-count for IPv6 per mac 58 origin fabric tracking enable reachable-lifetime 240 The following device-tracking counters show you that packet drops have occurred. However, the drops may be caused by reasons other than address spoofing as well. Use the information in the counters along with system messages to ascertain if spoofing has occurred. Device# show device-tracking counters vlan 11 Received messages on vlan 11 :
Protocol Protocol message NDP RS[4] RA[4] NS[1777] NA[2685] DHCPv6 ARP REQ[12] REP[1012] DHCPv4 ACD&DAD --[8] : Dropped messages on vlan 10 : Feature Protocol Msg [Total dropped] Device-tracking: ARP REQ [23] reason: Packet accepted but not forwarded [23] REP [450] reason: Silent drop [445] reason: Packet accepted but not forwarded [5] : Required configuration to display system messages: Device# device-tracking logging theft Device# device-tracking logging packet drop While the packet drops in the device-tracking counters do not conclusively prove that spoofing has occurred, the system messages help you ascertain this. %SISF-4-IP_THEFT:
IP Theft IP=3001::5 VLAN=10 Cand-MAC=aabb.cc00.6600 Cand-I/F=Et0/0 Known MAC aabb.cc00.6900 Known I/F Et0/1 %SISF-4-IP_THEFT: IP Theft IP=FE80::A8BB:CCFF:FE00:6900 VLAN=10 Cand-MAC=aabb.cc00.6600 Cand-I/F=Et0/0 Known MAC aabb.cc00.6900 Known I/F Et0/1 In the log, verified binding information (IP, MAC address, interface or VLAN) is preceded by the term "Known" . A suspicious IP address and MAC address is preceded by the term "New" or "Cand". Interface and VLAN information is also provided along with the suspiscious IP or MAC address - this helps you identify where the suspiscious traffic was seen. Configuring Switch Integrated Security Features Example:
Detecting and Preventing Spoofing Configuring Switch Integrated Security Features 37