Come up w/ a simple solution for layer2 / localnet topologies without IPAM.

We'd need to sort out the requirements for when IPAM (i.e. the subnets attribute) is defined on the network.

Some questions to address later on:

• can we have mac spoofing protection disabled and ip spoofing protection enabled at the same time ?
• does it make sense to have a single knob for this (disable port security) ?