Users Guide

Source Address Validation
Source Address Validation (SAV) is a security feature which helps switches to permit IP trac only from the clients present in the DHCP
snooping binding table.
When you enable SAV, the switch compares the source IP and MAC addresses in the packet with the DHCP snooping binding table. If
there is a match, the device forwards the packet. If there is no match, it drops the packet.
SAV is disabled by default.
NOTE: Dell EMC Networking recommends enabling SAV before enabling DHCP snooping on the system.
OS10 supports three types of Source Address Validation:
1 Source IP address validation
2 Source IP and MAC address validation
3 DHCP source MAC address validation
Source IP address validation
This feature lters IP trac, based on the source IP address and permits trac only from clients present in the DHCP snooping binding
table. The switch compares the following in the packet to the DHCP snooping binding table:
• Source IP address
• The VLAN to which the client is connected
• The port to which the client is connected
If there is a match, the switch forwards the packet.
Source IP and MAC address validation
This feature lters IP trac, based on both source IP and source MAC addresses and permits trac only from clients present in the DHCP
snooping binding table. The switch compares the following in the packet to the DHCP snooping binding table:
• Source MAC address
• Source IP address
• The VLAN to which the client is connected
• The port to which the client is connected
If there is a match, the switch forwards the packet.
DHCP source MAC address validation
The switch compares the source MAC address of the DHCP packet to the Client Hardware Address (CHADDR) eld in the DHCP packet
and drops the DHCP packet if there is a mismatch.
Restrictions for Source Address Validation
• As the SAV feature shares TCAM memory with user ACLs, the maximum number of SAV rules that the system can support depends on
how much TCAM memory is allocated to user ACLs.
Enable source IP address validation
• Enable source IP address validation in INTERFACE mode.
ip dhcp snooping source-address-validation ip [vlan vlan-name]
System management
185