set antispoof class threshold-index

Use this command to configure thresholds and actions for an anti-spoofing port class.

Syntax

Parameters

Defaults

• The class threshold-value defaults to 0 (threshold is disabled).
• The class quarantine-profile defaults to 0 (quarantine is disabled).
• If no action is specified, no action will be taken if the threshold is met. All actions default to disabled.

Mode

All command modes.

Usage

There are three anti-spoofing detection types: DHCP snooping, dynamic ARP inspection, and IP source guard. Each anti-spoofing detection type can be enabled on a port. Each port enabled anti-spoofing detection type tracks actionable anti-spoofing violations on the port based upon the detection type:

• DHCP snooping – A DHCP packet has been received on an untrusted switch port. Valid DHCP assigned addresses for clients on untrusted ports are determined by snooping DHCP server packets on trusted ports.
• Dynamic ARP inspection – An ARP packet has been received with a sender and target MAC to IP address binding that does not agree with a binding entry in the source MAC address to source IP address table.
• IP source guard – An IP packet has been received on the port with a source MAC and IP address that does not agree with a binding entry in the source MAC address to source IP address table.

An anti-spoofing class specifies one or more actions to be taken when the number of actionable violations configured in a class threshold occur on the port within the class timeout interval. The class timeout is configured using set antispoof class.

Anti-spoofing supports the configuration of up to 3 classes. Each port can be configured with a single class. If you only have a single anti-spoofing detection type enabled on the port, DHCP snooping for example, the action class thresholds and actions can be set for that anti-spoofing detection type. If multiple anti-spoofing types are configured on a port, DHCP snooping and dynamic ARP inspection for example, the class thresholds and actions must take into account any combination of anti-spoofing events for the configured anti-spoofing types.

Action CLI entries are not additive. Any specified action overwrites any previous class action configuration.

If the quarantine action is specified, ensure that a quarantine policy has been created and associated with the threshold. Extreme Networks highly recommends that you use quarantine policies to classify the user traffic upon violation hits. Quarantine policy profiles are configured using set policy profile. Policy rules using set policy rule (S-, K-Series) can be associated with the quarantine policy profile. The admin profile is not supported in a quarantine context.