IP Source Guard
IP Source Guard is a Layer 2 feature that works in conjunction with DHCP snooping. When IP Source Guard is enabled, all IP traffic on the port is initially blocked, with the exception of DHCP packets that are processed by the DHCP snooping feature (if enabled). After the end host receives a valid IP address from the DHCP server, or when a user configures a static IP source binding, a Port Access Control List (PACL) is applied on the port to restrict the client IP traffic to specific source IP addresses that are configured in the binding configuration. The switch drops all IP traffic with a source IP address other than that in the IP source binding.
An important note to remember is that if you configure IP Source Guard on a trunk port with a large number of VLANs that have DHCP snooping enabled, you might run out of ACL hardware resources, and depending on your platform, some packets might be switched in software. You can configure two levels of IP traffic filtering with IP Source Guard:
• Filtering source IP addresses: Only IP traffic with a source IP address that matches the IP source binding entry is permitted.
• Filtering on Source IP and MAC address: This is based on source IP address and its associated MAC address.
To enable IP Source Guard, use the ip verify source vlan dhcp-snooping interface subcommand, as shown in the following example:
interface GigabitEthernet1/1 ip verify source vlan dhcp-snooping
To verify the configuration, you can use the show ip verify source interface gigabitEthernet 1/1 command, as shown in the following example:
myswitch#show ip verify source interface gigabitEthernet 1/1
Interface Filter-type Filter-mode IP-address Mac-address Vlan
Gi1/1 ip-mac active 10.10.1.1 10
Gi1/1 ip-mac active deny-all 11-20
Continue reading here: Arbor Peakflow SP and Peakflow X
Was this article helpful?