При включенной option82 и dchp relay c такими параметрами # DHCP_RELAY enable dhcp_relay config dhcp_relay hops 4 config dhcp_relay time 0 config dhcp_relay port 1-28 state disable config dhcp_relay port 2-24 state enable config dhcp_relay vlan vlanid 1,50 state disable config dhcp_relay vlan vlanid 49 state enable config dhcp_relay add ipif System 10.80.80.253 config dhcp_relay option_82 state enable config dhcp_relay option_82 check disable config dhcp_relay option_82 policy keep config dhcp_relay option_82 remote_id default config dhcp_relay option_82 circuit_id default disable dhcp_local_relay disable dhcpv6_relay config dhcpv6_relay hop_count 4 config dhcpv6_relay option_37 state enable config dhcpv6_relay option_37 check enable config dhcpv6_relay option_37 remote_id default config dhcpv6_relay option_38 ports 1-28 state disable subscriber_id default
Smart binding c arp inspection в режиме strict не работает с любыми извращениями. # IMPBv2 disable address_binding dhcp_snoop ports 1,25-28 all config address_binding ip_mac ports 1,25-28 arp_inspection disable nd_inspection disable ip_inspection disable protocol all state disable allow_zeroip disable forward_dhcppkt enable config address_binding ip_mac ports 2-24 arp_inspection strict nd_inspection disable ip_inspection enable protocol all state enable allow_zeroip enable forward_dhcppkt enable config address_binding dhcp_snoop max_entry ports 1-28 limit no_limit config address_binding dhcp_snoop max_entry ports 1-28 limit no_limit IPv6 enable address_binding dhcp_snoop ports 2-24 all enable address_binding roaming config address_binding vlan_checking state disable config address_binding ip_mac log all disable address_binding dhcp_pd_snoop disable address_binding trap_log config filter dhcp_server ports 1-28 state disable config filter dhcp_server vlanid 1-4094 state disable config filter dhcp_server illegal_server_log_suppress_duration 5min config filter dhcp_server log state enable config filter dhcpv6_server ports 1-28 state disable config filter dhcpv6_server log state enable config filter icmpv6_ra_all_node ports 1-28 state disable config filter icmpv6_ra_all_node log state enable
Все исправляется если конфиг привести к виду # port config ports 1-24 speed auto state enable flow_control disable mdix auto learning enable description "" config ports 25-26 medium_type copper speed auto state enable flow_control disable mdix auto learning enable description "" config ports 25-26 medium_type fiber speed auto state enable flow_control disable learning enable description "" config ports 27-28 speed auto state enable flow_control disable learning enable description "" config ports 1-24 capability_advertised 10_half 10_full 100_half 100_full config ports 25-28 capability_advertised 10_half 10_full 100_half 100_full 1000_full
# port security config port_security 1-28 admin_state disable max_learning_addr 32 lock_address_mode DeleteOnTimeout
PORT SECURITY должен быть ниже #PORT в конфигурационном файле.
|