Dhcp Mac Source Address Validation; Enabling Ip+Mac Source Address Validation - Dell C9000 Series Networking Configuration Manual

Hide thumbs Also See for C9000 Series:

Table of Contents

impostering as a legitimate client, the source address appears on the wrong ingress port and the system

drops the packet. If the IP address is fake, the address is not on the list of permissible addresses for the port

and the packet is dropped. Similarly, if the IP address does not belong to the permissible VLAN, the packet is

To enable IP source address validation, use the following command.

If you enable IP source guard using the ip dhcp source-address-validation command and

if there are more entries in the current DHCP snooping binding table than the available CAM space, SAV

may not be applied to all entries. To ensure that SAV is applied correctly to all entries, enable the ip dhcp

source-address-validation command before adding entries to the binding table.

Enable IP source address validation.

INTERFACE mode

INTERFACE PORT EXTENDER

ip dhcp source-address-validation

Enable IP source address validation with VLAN option.

INTERFACE mode

ip dhcp source-address-validation vlan vlan-id

Before enabling SAV With VLAN option, allocate at least one FP block to the ipmacacl CAM region.

DHCP MAC Source Address Validation

DHCP MAC source address validation (SAV) validates a DHCP packet's source hardware address against the

client hardware address field (CHADDR) in the payload.

The system ensures that the packet's source MAC address is checked against the CHADDR field in the DHCP

header only for packets from snooped VLANs.

Enable DHCP MAC SAV.

CONFIGURATION mode

ip dhcp snooping verify mac-address

IP source address validation (SAV) validates the IP source address of an incoming packet against the DHCP

snooping binding table. IP+MAC SAV ensures that the IP source address and MAC source address are a

legitimate pair, rather than validating each attribute individually. You cannot configure IP+MAC SAV with IP

Allocate at least one FP block to the ipmacacl CAM region.

CONFIGURATION mode

Dynamic Host Configuration Protocol (DHCP)