On Wed, 9 Dec 2015, Roland Dobbins wrote:
On 9 Dec 2015, at 8:19, Laurent Dumont wrote:
arp-inspection
DAI is a self-defeating misfeature which can result in a self-DoS of the
switch. Don't enable it!
DHCP Snooping and IP Source Guard are very useful anti-spoofing mechanisms,
and should be enabled on the access ports.
Also, Root Guard, Loop Guard, and BPDU-Guard should be enabled in a
situationally-appropriate manner.
Don't forget to enable this for IPv6 as well. Potentially you could use
protocol based vlans and put each player port into its own /64 whch solves
most of the complexity and dynamic inspection stuff, you could even have
static ACLs on each subinterface/port if you want to.
--
Mikael Abrahamsson email: [email protected]
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
