HP 2530 User Manual

Debugging dynamic IP lockdown
To enable debugging of packets dropped by dynamic IP lockdown, enter the debug
dynamic-ip-lockdown command.
Syntax:
debug dynamic-ip-lockdown
To send command output to the active CLI session, enter the debug destination session
command.
Counters for denied packets are displayed in debug security dynamic-iplockdown
command output. Packet counts are updated every five minutes. “The debug dynamic-ip-lockdown
command output” (page 25) shows an example of command output.
When dynamic IP lockdown drops IP packets in VLAN traffic that do not contain a known source
IP-to-MAC address binding for the port where the packets are received, a message is entered in
the event log.
Syntax:
debug destination session
Example 17 The debug dynamic-ip-lockdown command output
HP Switch(config)# debug dynamic-ip-lockdown
DIPLD 01/01/90 00:01:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 1 packets
DIPLD 01/01/90 00:06:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 294 packets
DIPLD 01/01/90 00:11:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 300 packets
DIPLD 01/01/90 00:16:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 300 packets
DIPLD 01/01/90 00:21:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 299 packets
DIPLD 01/01/90 00:26:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 300 packets
DIPLD 01/01/90 00:31:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 300 packets
DIPLD 01/01/90 00:36:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 299 packets
DIPLD 01/01/90 00:41:25 : denied ip 192.168.2.100 (0)
(PORT 4) -> 192.168.2.1 (0), 300 packets
Differences between switch platforms
Differences in the feature set and operation of Dynamic IP Lockdown depend on the switch where
it is implemented as listed below.
• There is no restriction on GVRP on 2620, 3500, 3500yl, 5400zl, 6200yl, 6600, and 8200zl
switches.
• “Dynamic IP lockdown host limits” (page 26) shows host limits for dynamic IP Lockdown.
Dynamic IP Lockdown 25

HP 2530 Specifications

General

Layer	Layer 2
Operating Temperature	32°F to 113°F (0°C to 45°C)
Model	HP 2530
Power over Ethernet (PoE)	PoE+
Management	Web interface, CLI, SNMP
Memory	128 MB flash
Input Voltage	100-240 VAC
Jumbo Frame Support	Yes
Operating Humidity	15% to 95% non-condensing

Summary

1 Updates for the HP Switch Software Access Security Guide

Configuring advanced threat protection

Covers advanced threat protection features like DHCP snooping, Dynamic ARP protection, and Instrumentation monitor.

DHCP snooping

Details DHCP snooping for preventing DoS attacks by distinguishing trusted and untrusted ports.

Dynamic ARP protection

Explains how to protect networks from ARP poisoning attacks using dynamic ARP protection.

Dynamic IP Lockdown

This feature prevents IP source address spoofing by enforcing IP-to-MAC bindings.

Using the instrumentation monitor

How to use the instrumentation monitor to detect security anomalies and irregular operations.

Configuring RADIUS server support for switch services

Introduction

Explains configuring CoS, rate-limiting, and ACL client services via a RADIUS server.

Configuring and using dynamic (RADIUS-assigned) access control lists

Describes applying RADIUS-assigned ACLs to filter IP traffic from authenticated clients.

2 Updates for the HP Switch Software IPv6 Configuration Guide

Access Control Lists (ACLs)

Details configuring, applying, and editing static IPv6 ACLs for traffic filtering.

ACL applications

Covers filtering traffic from hosts, subnets, and applying ACLs at network edges.

RADIUS-assigned ACLs

Explains ACLs configured on a RADIUS server and assigned to authenticated clients.

Planning and configuring ACLs

Outlines steps for identifying ACL actions, designing ACLs, and applying them.

ACL operation

Describes how ACLs apply to ports, trunks, and filter traffic types.

Guidelines for planning ACL structure

Covers determining ACL application points and the order of ACEs for resource efficiency.

ACL configuration structure

Details the basic structure of an ACL, including identity, remarks, and ACEs.