Configure Ingress Filtering

To work with ingress traffic, you must ensure that the follow prerequisites are met:

• VLAN must be configured.

• PVID for the interfaces must be configured.

• Ingress filtering must be configured.

See Default Settings for the topology for this procedure.

1. Configure the VLAN in switch 1.

   SEFOS# configure terminal
   SEFOS(config)# vlan 2
   SEFOS(config-vlan)# ports extreme-ethernet 0/15 untagged extreme-ethernet 0/15
   SEFOS(config-vlan)# exit
   SEFOS(config)# interface extreme-ethernet 0/19
   SEFOS(config-if)# no shutdown
   SEFOS(config-if)# switchport pvid 2
   SEFOS(config-if)# exit
   SEFOS(config)# interface extreme-ethernet 0/15
   SEFOS(config-if)# no shutdown
   SEFOS(config-if)# switchport pvid 2
   SEFOS(config-if)# end

2. Wait for at least 30 seconds for the topology to settle, then ping host B from host A to ensure that the APR packet reaches host B.
3. Enable ingress filtering in port P15 at switch 1.

   SEFOS# configure terminal
   SEFOS(config)# interface extreme-ethernet 0/15
   SEFOS(config-if)# switchport ingress filter
   SEFOS(config-if)# end

4. Review the VLAN-related configurations.

   SEFOS# show vlan id 2
   Vlan database
   -------------------
   Vlan ID             : 2
   Member Ports        : Ex0/15
   Untagged Ports      : Ex0/15
   Forbidden Ports     : None
   Name                :
   Status              : Permanent
   ---------------------------------

5. Review the VLAN port configuration table.

   SEFOS# show vlan port config port extreme-ethernet 0/15
   Vlan Port configuration table
   -------------------------------
   Port Ex0/15
   Port  Vlan ID                        : 2
   Port Acceptable Frame Type           : Admit All
   Port Ingress Filtering               : Enabled
   Port Mode                            : Hybrid
   Port Gvrp Status                     : Enabled
   Port Gmrp Status                     : Enabled
   Port Gvrp Failed Registrations       : 0
   Gvrp last pdu origin                 : 00:00:00:00:00:00
   Port Restricted Vlan Registration    : Disabled
   Port Restricted Group Registration   : Disabled
   Mac Based Support                    : Disabled
   Subnet Based Support                 : Disabled
   Port-and-Protocol Based Support      : Enabled
   Default Priority                     : 0
   Tunnel Status                        : Disabled
   Dot1x Protocol Tunnel Status         : Peer
   LACP Protocol Tunnel Status          : Peer
   Spanning Tree Tunnel Status          : Peer
   GVRP Protocol Tunnel Status          : Peer
   GMRP Protocol Tunnel Status          : Peer
   IGMP Protocol Tunnel Status          : Peer
   Filtering Utility Criteria           : Default
   Port Protected Status                : Disabled
   ----------------------------------------------------

   The APR packet should reach host B when ingress filtering is enabled.