Configuring Link Protection (Task Map)

To use link protection, you use one of the options of the dladm command to set the link properties. If the type of protection works with other configuration files, for example, ip-nospoof with allowed-ips, then you perform two general actions. First, you enable link protection. Then, you customize the configuration file to determine how the link protection operates.

The following points to the tasks that you can use to configure link protection on a Oracle Solaris server.

How to Enable the Link Protection Mechanism

This procedure enables one or more of the following link protection types: mac-nospoof, ip-nospoof, and restricted.

1. Become an administrator.

   For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

2. Enable link protection by specifying one or more protection types.

   # dladm set-linkprop -p protection=value[,value,...] link

   In the following example, all three link protection types on the vnic0 link are enabled:

   # dladm set-linkprop -p protection=mac-nospoof,ip-nospoof,restricted vnic0

How to Disable Link Protection

This procedure resets link protection to the default values, which disables link protection.

1. Become an administrator.

   For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

2. Disable link protection by resetting the protection property to its default value.

   # dladm reset-linkprop -p protection link

How to Specify IP Addresses for Protection Against IP Spoofing

Note that the allowed-ips property is used only if the protection property enables the ip-nospoof protection type.

1. Become an administrator.

   For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

2. Make sure that you have enabled protection from IP spoofing.

   If you have not yet enabled this type of link protection, then issue the following command:

   # dladm set-linkprop -p protection=ip-nospoof

3. Specify a list of IP addresses as values for the allowed-ips link property.

   # dladm set-linkprop -p allowed-ips=IP-addr[,IP-addr,...] link

   The following example shows how to specify the 10.0.0.1 and 10.0.0.2 IP addresses as values for the allowed-ips property for the vnic0 link:

   # dladm set-linkprop -p allowed-ips=10.0.0.1,10.0.0.2 vnic0

How to View the Link Protection Configuration

The values of the protection and allowed-ips properties indicate how link protection is configured. Note that the allowed-ips property is used only if the protection property specifies the ip-nospoof protection type.

1. Become an administrator.

   For more information, see How to Obtain Administrative Rights in System Administration Guide: Security Services.

2. View the link protection property values.

   # dladm show-linkprop -p protection,allowed-ips link

   The following example shows the values for the protection and allowed-ips properties for the vnic0 link:

   # dladm show-linkprop -p protection,allowed-ips vnic0
   LINK      PROPERTY        PERM     VALUE           DEFAULT     POSSIBLE
   vnic0     protection      rw       ip-nospoof      --          --
                                      mac-nospoof
                                      restricted
   vnic0     allowed-ips     rw       10.0.0.1,       --          --
                                      10.0.0.2