Installation manual

3-123
SIGNAMAX LLC • www.signamax.eu
IP Source Guard
IP Source Guard is a security feature that filters IP traffic on network interfaces based on
manually configured entries in the IP Source Guard table, or dynamic entries in the DHCP
Snooping table when enabled (see “DHCP Snooping” on page 3-116). IP source guard
can be used to prevent traffic attacks caused when a host tries to use the IP address of a
neighbor to access the network. This section describes commands used to configure IP
Source Guard.
Configuring Ports for IP Source Guard
Use the IP Source Guard Port Configuration page to set the filtering type based on source
IP address or source IP address and MAC address pair.
IP Source Guard is used to filter traffic on an unsecure port which receives messages
from outside the network or firewall, and therefore may be subject to traffic attacks
caused by a host trying to use the IP address of a neighbor.
Command Usage
• Setting source guard mode to SIP (Source IP) or SIP-MAC (Source IP and MAC)
enables this function on the selected port. Use the SIP option to check the VLAN ID,
source IP address, and port number against all entries in the binding table. Use the
SIP-MAC option to check these same parameters, plus the source MAC address. If no
matching entry is found, the packet is dropped.
• When enabled, traffic is filtered based upon dynamic entries learned via DHCP snooping
(see “Configuring DHCP Snooping” on page 3-117), or static addresses configured in
the source guard binding table.
• If IP source guard is enabled, an inbound packet’s IP address (sip option) or both its IP
address and corresponding MAC address (sip-mac option) will be checked against the
binding table. If no matching entry is found, the packet will be dropped.
• Filtering rules are implemented as follows:
- If the DHCP snooping is disabled (see page 3-117), IP source guard will check the
VLAN ID, source IP address, port number, and source MAC address (for the sip-mac
option). If a matching entry is found in the binding table and the entry type is static IP
source guard binding, the packet will be forwarded.
- If the DHCP snooping is enabled, IP source guard will check the VLAN ID, source IP
address, port number, and source MAC address (for the sip-mac option). If a
matching entry is found in the binding table and the entry type is static IP source guard
binding, or dynamic DHCP snooping binding, the packet will be forwarded.
- If IP source guard if enabled on an interface for which IP source bindings have not yet
been configured (neither by static configuration in the IP source guard binding table
nor dynamically learned from DHCP snooping), the switch will drop all IP traffic on that
port, except for DHCP packets.