ECS4660-28F_Management Guide-R03

C HAPTER 29 | General Security Measures
IPv6 Source Guard
– 1143 –
◆ Filtering rules are implemented as follows:
■
If ND snooping and DHCPv6 snooping are disabled, IP source guard
will check the VLAN ID, source IPv6 address, and port number. If a
matching entry is found in the binding table and the entry type is
static IP source guard binding, the packet will be forwarded.
■
If ND snooping or DHCP snooping is enabled, IP source guard will
check the VLAN ID, source IP address, and port number. If a
matching entry is found in the binding table and the entry type is
static IP source guard binding, dynamic ND snooping binding, or
dynamic DHCPv6 snooping binding, the packet will be forwarded.
■
If IP source guard if enabled on an interface for which IPv6 source
bindings (dynamically learned via ND snooping or DHCP snooping,
or manually configured) are not yet configured, the switch will drop
all IPv6 traffic on that port, except for ND packets and DHCPv6
packets.
■
Only IPv6 global unicast addresses are accepted for static bindings.
EXAMPLE
This example enables IP source guard on port 5.
Console(config)#interface ethernet 1/5
Console(config-if)#ipv6 source-guard sip
Console(config-if)#
RELATED COMMANDS
ipv6 source-guard binding (1140)
ipv6 dhcp snooping (1126)
ipv6 dhcp snooping vlan (1129)
ipv6 source-guard
max-binding
This command sets the maximum number of entries that can be bound to
an interface. Use the no form to restore the default setting.
SYNTAX
ipv6 source-guard max-binding number
no ipv6 source-guard max-binding
number - The maximum number of IPv6 addresses that can be
mapped to an interface in the binding table. (Range: 1-5)
DEFAULT SETTING
5
COMMAND MODE
Interface Configuration (Ethernet)