Hello Community,
I was wondering about the appropriate way to configure ARP Validation in an Extreme Access Control Environment with dynamically assigned VLANs.
From what I have found so far, you have to configure ARP Validation per vlan and port. This is not possible if the vlan, which should later be dynamically assigned to the port, is not statically configured on the port:
* EXOS-VM.2 # enable ip-security dhcp-snooping vlan red ports 1 violation-action drop-packet block-mac duration 300 snmp-trap
ERROR: Port 1 does not belong to vlan red.
* EXOS-VM.4 # enable ip-security arp validation vlan red ports 1 violation-action drop-packet snmp-trap
ERROR: Port 1 does not belong to vlan red.
I have seen that in XOS 30.2 a Dynamic VLAN and VLAN ID option has been added. I assume this option is only for VLANs created in a Fabric Connect environment and not for dynamically assigned VLANs based on an Authentication. Is my assumption correct?
I know that IP-Security Features apply after the Authentication takes place. What I would not want to do is an implementation with a port macro - if this is even possible.
Could someone please help me?
Kind regards
Michael
