IP-MAC binding

Use IP-MAC binding to prevent ARP spoofing.

The port accepts a packet only if the source IP address and source MAC address in the packet match an entry in the IP-MAC binding table.

You can enable or disable IP-MAC binding for the whole switch, and you can override this global setting for each port.

Configuring IP-MAC binding

Use the following steps to configure IP-MAC binding:

1. Enable the IP-MAC binding global setting.
2. Create the IP-MAC bindings. You can activate each binding individually.
3. Set each port to follow the global setting. You can also override the global setting for individual ports by enabling or disabling IP-MAC binding for the port.

Using the GUI:

Create the IP-MAC binding:

1. Go to Switch > IP MAC Binding.
2. Select Add IP MAC Binding to create a new binding.
3. Select Status.
4. Enter the IP address and netmask.
5. Enter the MAC address.
6. Select Add.

Using the CLI:

config switch global

set ip-mac-binding [enable| disable]

config switch ip-mac-binding

edit 1

set ip <IP address and network mask>

set mac <MAC address>

set status (enable| disable)

next

end

config switch interface

edit <port>

set ip-mac-binding (enable| disable | global)

edit <trunk name>

set ip-mac-binding (enable| disable | global)

Notes:

• For a switch port, the default IP-MAC binding value is disabled.
• When you configure a trunk, the trunk follows the global value by default. You can also explicitly enable or disable IP-MAC binding for a trunk, as shown in the CLI configuration.
• When you add member ports to the trunk, all ports take on the trunk setting. If you later remove a port from the trunk group, the port is reset to the default value (disabled).
• No duplicate entries are allowed in the mapping table.
• Rules are disabled by default. You need to explicitly enable each rule.
• The mapping table holds up to 1024 rules.

Viewing IP-MAC binding configuration

Display the status of IP-MAC binding using the following command:

show switch ip-mac-binding <entry number>