Users Guide

Layer 2 Switching Commands 546
• The state of associated interface changes from forwarding to non-
forwarding.
• If DHCP snooping is disabled, entries added via DHCP snooping are
marked INACTIVE.
• The DHCP lease associated with the table entry is terminated or deleted.
Only ARP packets that are validated by Dynamic ARP Inspection (if enabled)
are processed by IPDT.
The Authentication Manager utilizes the IP/MAC device entries in the IPDT
table to populate the source IP address in Dynamic Access Control Lists
while authenticating clients. In this case, DHCP snooping must be enabled
and properly configured by the administrator. DHCP snooping is able to
snoop DHCP packets on 802.1X unauthenticated ports configured in 802.1X
auto mode.
The administrator can configure the maximum number of host entries that
can be added to the tracking table per interface. When adding a new entry, if
the number of entries on an interface exceeds the configured limit, all entries
associated with the interface are deleted from the table.
Command History
Command introduced in version 6.6.0 firmware.
Example
This example globally enables IP Device Tracking and DHCP snooping on
VLAN1. IPDT relies on DHCP snooping and ARP probes to populate its
bindings table. The DHCP server is reachable from interface Te1/0/1.
console(config)#ip device tracking
console(config)#ip dhcp snooping
console(config)#ip dhcp snooping vlan 1
console(config)#interface te1/0/1
console(config-if-Te1/0/1)#ip dhcp snooping trust
console(config-if-Te1/0/1)#exit
ip device tracking probe
Use the ip device tracking probe command to enable sending of ARP probes
for IP device tracking.