• Address Resolution Protocol (ARP) packets. Starting with Cisco IOS XE Amsterdam 17.3.1, ARP packets are throttled to mitigate high CPU utilization scenarios. In a five second window, a maximum of 50 ARP packets, from the same source, are processed by SISF. Note that the limit of 50 in five seconds is for each binding entry, that is, for each source IP. Starting with Cisco IOS XE Cupertino 17.7.1, all ARP (ARP REQUEST and ARP REPLY) packets are dropped if • the limit is reached and • the security level of the device tracking policy is set to guard. In Cisco IOS XE 17.14.1, this limit is increased to a maximum of 100 ARP packets for each source IP.
All ARP (ARP REQUEST and ARP REPLY) packets are dropped if • the limit is reached and • the security level of the device tracking policy is set to guard. • Neighbor Discovery Protocol (NDP) packets. • Multiple Identity Association-Nontemporary Address (IA_NA) and Identity Association-Prefix Delegation (IA_PD). In some cases, a network device can request and receive more than one IPv6 address from the DHCP server. This may be done to provide addresses to multiple clients of the device, such as when a residential gateway requests addresses to distribute to its LAN clients. When the device sends out a DHCPv6 packet, the packet includes all of the addresses that have been assigned to the device.
When SISF analyzes a DHCPv6 packet, it examines the IA_NA (Identity Association-Nontemporary Address) and IA_PD (Identity Association-Prefix Delegation) components of the packet and extracts each IPv6 address contained in the packet. SISF adds each extracted address to the binding table. Entries created through learning events like the ones listed above are called "dynamic entries". In the output of the show device-tracking database details privileged EXEC command, such entries are prefixed with an abbreviation that clarifies the kind of dynamic learning event it was. For example, ARP for ARP packets, ND for NDP packets, and so on. • Configuring static binding entries.
If there are silent but reachable hosts in the Layer 2 domain, you can create static binding entries to retain binding information even if the host becomes silent. A static binding entry is a binding entry that is manually added to the binding table, by configuring the following command in global configuration mode:
device-tracking binding vlan vlan_id { ipv4_add ipv6_add ipv6_prefix } [ interface inteface_type_no ] [ 48-bit-hardware-address ] [ reachable-lifetime { seconds | default | infinite } | tracking { default | disable | enable [ retry-interval { seconds | default } ] } [ reachable-lifetime { seconds | default | infinite } ] ] In the output of the show device-tracking database details privileged EXEC command, static entries are prefixed with the letter "S". Configuring Switch Integrated Security Features Binding Table Sources Configuring Switch Integrated Security Features 6