Verify IPDT Device Operations - Cisco
文章推薦指數： 80 %
Introduction. This document describes how to verify IP Device Tracking (IPDT) operations and how to disable these actions. Prerequisites. Requirements.
Skiptocontent
Skiptosearch
Skiptofooter
SupportTechnologySupportIPIPRoutedProtocolsTroubleshootingTechNotes
VerifyIPDTDeviceOperations
Save
LogintoSaveContent
Translations
Download
Print
AvailableLanguages
DownloadOptions
PDF
(60.4KB)
ViewwithAdobeReaderonavarietyofdevices
ePub
(84.5KB)
ViewinvariousappsoniPhone,iPad,Android,SonyReader,orWindowsPhone
Mobi(Kindle)
(75.9KB)
ViewonKindledeviceorKindleapponmultipledevices
Updated:July26,2022
DocumentID:118630
Bias-FreeLanguage
Bias-FreeLanguage
Thedocumentationsetforthisproductstrivestousebias-freelanguage.Forthepurposesofthisdocumentationset,bias-freeisdefinedaslanguagethatdoesnotimplydiscriminationbasedonage,disability,gender,racialidentity,ethnicidentity,sexualorientation,socioeconomicstatus,andintersectionality.Exceptionsmaybepresentinthedocumentationduetolanguagethatishardcodedintheuserinterfacesoftheproductsoftware,languageusedbasedonRFPdocumentation,orlanguagethatisusedbyareferencedthird-partyproduct.LearnmoreabouthowCiscoisusingInclusiveLanguage.
ContentsIntroductionPrerequisitesRequirementsComponentsUsedIPDTOverviewDefinitionandUsageExcerptProblemDefaultStateandOperationFunctionalityAreasFeatureMatrixFeaturesDisableIPDTEntertheipdevicetrackingprobedelay10 CommandEntertheipdevicetrackingprobeuse-svi CommandEntertheipdevicetrackingprobeauto-source[fallback][override ] CommandEnterthe ipdevicetrackingprobeauto-source CommandEntertheipdevicetrackingprobeauto-sourcefallback0.0.0.1255.255.255.0 CommandEntertheipdevicetrackingprobeauto-sourcefallback0.0.0.1255.255.255.0override CommandEntertheipdevicetrackingmaximum0 CommandTurnOffActiveFeaturesthatTriggerIPDTExampleVerifyIPDTOperation
Introduction
ThisdocumentdescribeshowtoverifyIPDeviceTracking(IPDT)operationsandhowtodisabletheseactions.
Prerequisites
Requirements
Therearenospecificrequirementsforthisdocument.
ComponentsUsed
Thisdocumentisnotrestrictedtospecificsoftwareandhardwareversions.However,theoutputsinthisdocumentwerebasedonthesesoftwareandhardwareversions:
CiscoWS-C2960X
CiscoIOS®15.2
Theinformationinthisdocumentwascreatedfromthedevicesinaspecificlabenvironment.Allofthedevicesusedinthisdocumentstartedwithacleared(default)configuration.Ifyournetworkislive,ensurethatyouunderstandthepotentialimpactofanycommand.
IPDTOverview
DefinitionandUsage
ThemainIPDTtaskistokeeptrackofconnectedhosts(associationofMACandIPaddress).Inordertodothis,itsendsunicastAddressResolutionProtocol(ARP)probeswithadefaultintervalof30seconds;theseprobesaresenttotheMACaddressofthehostconnectedontheothersideofthelink,anduseLayer2(L2)asthedefaultsourcetheMACaddressofthephysicalinterfaceoutofwhichtheARPgoesandasenderIPaddressof0.0.0.0,basedontheARPProbedefinitionlistedinRFC5227.
Excerpt
Inthisdocument,theterm'ARPProbe'isusedtorefertoanARPRequestpacket,broadcastonthelocallink,withanall-zero'senderIPaddress'.The'senderhardwareaddress'MUSTcontainthehardwareaddressoftheinterfacethatsendsthepacket.The'senderIPaddress'fieldMUSTbesettoallzeroes,toavoidcorruptionARPcachesinotherhostsonthesamelinkinthecasewheretheaddressturnsouttobealreadyinusebyanotherhost.The'targetIPaddress'fieldMUSTbesettotheaddressthatisprobed.AnARPProbeconveysbothaquestion(Doesanyoneusethisaddress?)andanimpliedstatement(ThisistheaddressIhopetouse.).
ThepurposeofIPDTisfortheswitchtoobtainandmaintainalistofdevicesthatareconnectedtotheswitchviaanIPaddress.Theprobedoesnotpopulatethetrackingentry;itissimplyusedinordertomaintaintheentryinthetableafteritislearnedthroughanARPrequest/replyfromthehost.
IPARPInspectionisenabledautomaticallywhenIPDTisenabled;itdetectsthepresenceofnewhostswhenitmonitorsARPpackets.IfdynamicARPinspectionisenabled,onlytheARPpacketsthatitvalidatesareusedinordertodetectnewhostsfortheDeviceTrackingtable.
IPDHCPsnooping,ifenabled,detectsthepresenceorremovalofnewhostswhenDHCPassignsorrevokestheirIPaddresses. WhenDHCPtrafficisseenforagivenhost,theIPDTARPprobeintervaltimerisreset.
IPDTisafeaturethathasalwaysbeenavailable.However,onmorerecentCiscoIOS®releases,itsinterdependenciesareenabledbydefault(see'CiscobugIDCSCuj04986').ItcanbeextremelyusefulwhenitsdatabaseofIP/MAChostsassociationsisusedinordertopopulatethesourceIPofdynamicAccessControlLists(ACLs),ortomaintainabindingofanIPaddresstoasecuritygrouptag.
TheARPprobeissentundertwocircumstances:
ThelinkassociatedwithacurrententryintheIPDTdatabasemovesfromaDOWNtoanUPstate,andtheARPentryhasbeenpopulated.
AlinkalreadyintheUPstatethatisassociatedwithanentryintheIPDTdatabasehasanexpiredprobeinterval.
Problem
The“keepalive”probesentbytheswitchisaL2check.Assuchfromtheswitch’spointofview,theIPaddressesusedassourceintheARPsarenotimportant:thisfeaturecanbeusedondeviceswithnoIPaddressconfiguredatall,sotheIPsourceof0.0.0.0isnotrelevant.
Whenthehostreceivesthismessages,itrepliesbackandpopulatesthedestinationIPfieldwiththeonlyIPaddressavailableinthereceivedpacket,whichisitsownIPaddress.ThiscancausefalseduplicateIPaddressalerts,becausethehostthatrepliesseesitsownIPaddressasboththesourceandthedestinationofthepacket;refertotheDuplicateIPAddress0.0.0.0.ErrorMessageTroubleshootarticleformoreinformationabouttheduplicateIPaddressscenario.
DefaultStateandOperation
Theglobalon/offconfigforIPDTisalegacybehaviorwhichcausedissuesinthefieldascustomerswerenotalwaysawaretheyneededtoturnonIPDTforcertainfeaturestowork.Incurrentreleases,IPDTissolelycontrolledataninterfacelevelwhenitenablesafeaturethatrequiresIPDT.
IPDTisongloballybydefaultwithinthesereleases;thatis,noglobalconfigcommanddueto'CiscobugID CSCua85383':
Catalyst2k/3k:15.2(1)E
Catalyst3850:3.2.0SE
Catalyst4k:15.2(1)E/3.5.0E
Itisimportanttonotethat,evenifIPDTisenabledglobally,thatdoesnotnecessarilyimplythatIPDTactivelymonitorsagivenport.
OnreleaseswhereIPDTisalwaysonandwhereIPDTcanbegloballytoggledoff/on,whenIPDTisenabledglobally,otherfeaturesactuallydeterminewhetheritisactiveonaspecificinterface(seetheFunctionalityAreassection).
FunctionalityAreas
IPDTanditsARPprobessentoutofagiveninterfaceareusedforthesefeatures:
NetworkMobilityServicesProtocol(NMSP),Versions3.2.0E,15.2(1)E,3.5.0Eandlater
Devicesensor,Versions15.2(1)E,3.5.0Eandlater
1X,MACAuthenticationBypass(MAB),sessionmanager
Web-basedauthentication
Auth-proxy
IPSourceGuard(IPSG)forstatichosts
Flexiblenetflow
CiscoTrustSec(CTS)
Mediatrace
HTTPredirects
FeatureMatrix
Platform
Feature
Defaulton(StartIn)
DisableMethod
DisableCLI
Cat2960/3750(CiscoIOS)
IPDT
15.2(1)E*
globalCLI(olderreleases)*
per-interface
noipdevicetracking*
ipdevicetrackingmaximum0***
Cat2960/3750 (CiscoIOS)
NMSP
no
globalCLIor
per-interfaceCLI
nonmspenable
nmspattachmentsuppress****
Cat2960/3750 (CiscoIOS)
DeviceSensor
15.0(1)SE
globalCLI
nomacroautomonitor
Cat2960/3750 (CiscoIOS)
ARPSnooping
15.2(1)E**
n/a
n/a
Cat3850
IPDT
allreleases*
per-interface*
ipdevicetrackingmaximum0***
Cat3850
NMSP
allreleases
per-interface
nmspattachmentsuppress
Cat3850
DeviceSensor
no
n/a
n/a
Cat3850
ARPSnooping
allreleases**
n/a
n/a
Cat4500
IPDT
15.2(1)E/3.5.0E*
globalCLI(olderreleases)*
per-interface
noipdevicetracking*
ipdevicetrackingmaximum0***
Cat4500
NMSP
no
globalCLIor
per-interfaceCLI
nonmspenable
nmspattachmentsuppress****
Cat4500
DeviceSensor
15.1(1)SG/3.3.0SG
globalCLI
nomacroautomonitor
Cat4500
ARPSnooping
15.2(1)E/3.5.0E**
n/a
n/a
Features
IPDTcannotbedisabledgloballyinnewerreleases,butIPDTisonlyactiveonportsiffeaturesthatrequireitareactive.
ARPsnoopingisonlyactiveifspecificfeaturecombinationsenableit.
IfyoudisableIPDTonaper-interfacebasisdoesnotstopARPsnoopingitdoespreventIPDTtracking.Thisisavailablefromi3.3.0SE,15.2(1)E,3.5.0Eandlater.
Per-interfaceNMSPsuppressiononlyavailableifNMSPisenabledglobally.
DisableIPDT
OnreleaseswhereIPDTisnotenabledbydefault,IPDTcanbeturnedoffgloballywiththiscommand:
Switch(config)#noipdevicetracking
OnreleaseswhereIPDTisalwayson,thepreviouscommandisnotavailable,oritdoesnotallowyoutodisableIPDT('CiscobugIDCSCuj04986').Inthiscase,thereareseveralwaystoensurethatIPDTdoesnotmonitoraspecificportoritdoesnotgenerateduplicateIPalerts.
Entertheipdevicetrackingprobedelay10 Command
Thiscommanddoesnotallowaswitchtosendaprobefor10secondswhenitdetectsalinkUP/flap,whichminimizesthepossibilitytohavetheprobesentwhilethehostontheothersideofthelinkchecksforduplicateIPaddresses.TheRFCspecifiesa10-secondwindowforduplicateaddressdetection,soifyoudelaythedevice-trackingprobe,theissuecanbesolvedinmostcases.
IftheswitchsendsoutanARPProbefortheclientwhilethehost(forexample,aMicrosoftWindowsPC)isinitsDuplicate-AddressDetectionphase,thehostdetectstheprobeasaduplicateIPaddressandpresentstheuserwithamessagethataduplicateIPaddresswasfoundonthenetwork.IfthePCdoesnotobtainanaddress,andtheusermustmanuallyrelease/renewtheaddress,disconnect,andreconnecttothenetwork,orrebootthePCinordertogainnetworkaccess.
Inadditiontoprobe-delay,thedelayalsoresetsitselfwhentheswitchdetectsaprobefromthePC/host.Forexample,iftheprobetimerhascounteddowntofivesecondsanddetectsanARPProbefromthePC/host,thetimerresetsbackto10seconds.
Thisconfigurationhasbeenmadeavailablethrough'CiscobugIDCSCtn27420'.
Entertheipdevicetrackingprobeuse-svi Command
Withthiscommand,youcanconfiguretheswitchinordertosendanon-RFCcompliantARPProbe;theIPsourceisnotbe0.0.0.0,butitistheSwitchVirtualInterface(SVI)intheVLANwherethehostresides.MicrosoftWindowsmachinesnolongerseetheprobeasaprobeasdefinedbyRFC5227anddonotflagapotentialduplicateIP.
Entertheipdevicetrackingprobeauto-source[fallback
延伸文章資訊
- 1IP Device Tracking - Cisco Content Hub
The IP Device Tracking maintains a database of IP and MAC addresses that are used to get the sour...
- 2Verify IPDT Device Operations - Cisco
Introduction. This document describes how to verify IP Device Tracking (IPDT) operations and how ...
- 3Thoughts on IP device tracking? : r/networking - Reddit
Strictly Cisco shop FYI. I am slowly doing a deployment of ISE in our infrastructure and came acr...
- 4How to Enable IP Device Tracking in Cisco Switch - YouTube
- 5Cisco Switches with IPDT Cause Duplicate IPs
Run these two commands to completely disable the ip device tracking function on the affected Cisc...
