Installation guide

Configuring the Switch
3-122
3
Web – Click DHCP Snooping, DHCP Snooping Binding Information.
Figure 3-73 DHCP Snooping Binding Information
CLI – This example shows how to display the DHCP Snooping binding table entries.
IP Source Guard
IP Source Guard is a security feature that filters IP traffic on network interfaces
based on manually configured entries in the IP Source Guard table, or dynamic
entries in the DHCP Snooping table when enabled (see “DHCP Snooping” on page
3-115). IP source guard can be used to prevent traffic attacks caused when a host
tries to use the IP address of a neighbor to access the network. This section
describes commands used to configure IP Source Guard.
Configuring Ports for IP Source Guard
Use the IP Source Guard Port Configuration page to set the filtering type based on
source IP address or source IP address and MAC address pair.
IP Source Guard is used to filter traffic on an unsecure port which receives
messages from outside the network or firewall, and therefore may be subject to
traffic attacks caused by a host trying to use the IP address of a neighbor.
Command Usage
• Setting source guard mode to SIP (Source IP) or SIP-MAC (Source IP and MAC)
enables this function on the selected port. Use the SIP option to check the VLAN
ID, source IP address, and port number against all entries in the binding table. Use
the SIP-MAC option to check these same parameters, plus the source MAC
address. If no matching entry is found, the packet is dropped.
• When enabled, traffic is filtered based upon dynamic entries learned via DHCP
snooping (see “Configuring DHCP Snooping” on page 3-117), or static addresses
configured in the source guard binding table.
Console#show ip dhcp snooping binding 4-165
MacAddress IpAddress Lease(sec) Type VLAN Interface
----------------- --------------- ---------- -------------------- ---- ---------
00-10-60-db-37-6b 192.168.0.4 2147483385 dhcp-snooping 1 Eth 1/3
Console#