This section explains the purpose of some of the important policy parameters so you can configure your policy to better suit your requirements. Device(config)# device-tracking policy example_policy Device(config-device-tracking)# ? device-tracking policy configuration mode: device-role Sets the role of the device attached to the port limit Specifies a limit security-level setup security level tracking Override default tracking behavior trusted-port setup trusted port For information about all the paramters displayed in the device-tracking configuration mode, see the command reference document of the corresponding release.
Glean versus Guard versus Inspect When a packet enters the network, SISF extracts the IP and MAC address (the source of the packet) and subsequent action, is dictated by the security-level that is configured in the policy. Glean, guard, and inspect are the options available under the security-level parameter. Glean is the least secure option, inspect, is moderately secure, and guard, is the most secure. To configure this parameter in a policy, enter the security-level keyword in the device-tracking configuration mode. Glean When the security-level is set to glean , SISF extracts the IP and MAC address and enters them into the binding table, without any verification.
This option therefore does not ensure binding integrity. It may for example, be suited to a set-up where client applications such as IEEE 802.1X or SANET want to only learn about the host and not rely on SISF for authentication. The only factor that affects the addition of the binding entry for this security-level, is the address count limit. There are separate limits for the maximum number of IPs per port, IPv4 per MAC, and IPv6 per MAC. Entries are rejected once a limit is reached. For more information about this parameter, see Address Count Limits, on page 17 . Guard This is the default value for the security-level parameter.
When the security-level is set to guard , SISF extracts and verifies the IP and MAC address of packets entering the network. The outcome of the verification determines if a binding entry is added, or updated, or if the packet is dropped and the client is rejected. The process of verification starts with the search for a matching entry in the database. The database may be centralised or distributed. If a matching entry is not found, a new entry is added. If a matching entry is found and the points of attachment (MAC, VLAN, or interface) are found to be the same, only the timestamp is updated. If not, the scope of verification is extended to include validation of address ownership.
This may include host polling to determine if the change in the point of attachment (a different MAC, or VLAN) is valid. If the change is valid the entry is updated, or if it is a case of theft, the entry is not added to the binding table. Configuring Switch Integrated Security Features Glean versus Guard versus Inspect Configuring Switch Integrated Security Features 9