CLI Reference Guide-R05

Chapter 9 | General Security Measures
IP Source Guard
– 317 –
ip source-guard
binding
This command adds a static address to the source-guard binding table. Use the no
form to remove a static entry.
Syntax
ip source-guard binding mac-address vlan vlan-id ip-address
interface ethernet unit/port
no ip source-guard binding mac-address vlan vlan-id
mac-address - A valid unicast MAC address.
vlan-id - ID of a configured VLAN for an ACL filtering table or a range of
VLANs for a MAC address filtering table. To specify a list separate
nonconsecutive VLAN identifiers with a comma and no spaces; use a
hyphen to designate a range of IDs. (Range: 1-4094)
ip-address - A valid unicast IP address, including classful types A, B or C.
unit - Unit identifier. (Range: 1)
port-list - Physical port number or list of port numbers. Separate
nonconsecutive port numbers with a comma and no spaces; or use a
hyphen to designate a range of port numbers. (Range: 1-12)
Default Setting
No configured entries
Command Mode
Global Configuration
Command Usage
◆ Table entries include a MAC address, IP address, lease time, entry type (Static-IP-
SG-Binding, Dynamic-DHCP-Binding), VLAN identifier, and port identifier.
◆ All static entries are configured with an infinite lease time, which is indicated
with a value of zero by the show ip source-guard command.
◆ When source guard is enabled, traffic is filtered based upon dynamic entries
learned via DHCP snooping, or static addresses configured in the source guard
binding table with this command.
ip source-guard max-binding Sets the maximum number of entries that can be bound
to an interface
IC
show ip source-guard Shows whether source guard is enabled or disabled on
each interface
PE
show ip source-guard binding Shows the source guard binding table PE
Table 60: IP Source Guard Commands
Command Function Mode