Ip Source Guard; Ip Source Guard Overview - ZyXEL Communications GS2210-8 User Manual

26.1 IP Source Guard Overview

Use I Pv4 and I Pv6 source guard t o filt er unaut horized DHCP and ARP packet s in your net work.
I P source guard uses a binding t able t o dist inguish bet ween aut horized and unaut horized DHCP and
ARP packet s in your net work. A binding cont ains t hese key at t ribut es:
• MAC address
• VLAN I D
• I P address
• Port num ber
When t he Swit ch receives a DHCP or ARP packet , it looks up t he appropriat e MAC address, VLAN I D,
I P address, and port num ber in t he binding t able. I f t here is a binding, t he Swit ch forwards t he
packet . I f t here is not a binding, t he Swit ch discards t he packet .
26.1.1 What You Can Do
• Use t he I P Sou r ce Gua r d screen (
configurat ion screens where you can configure I Pv4 or I Pv6 source guard set t ings.
• Use t he I Pv4 Sour ce Gu a r d Se t u p screen (
bindings for DHCP snooping and ARP inspect ion.
• Use t he I P Sour ce Gua r d St a t ic Binding screen (
bindings for DHCP snooping and ARP inspect ion.
• Use t he D H CP Sn oopin g screen (
t he DHCP snooping dat abase.
• Use t his D H CP Sn oopin g Con figu r e screen (
snooping on t he Swit ch ( not on specific VLAN) , specify t he VLAN where t he default DHCP server
is locat ed, and configure t he DHCP snooping dat abase.
• Use t he D H CP Sn oopin g Por t Con figur e screen (
whet her port s are t rust ed or unt rust ed port s for DHCP snooping.
• Use t he D H CP Sn ooping VLAN Con figu r e screen (
snooping on each VLAN and t o specify whet her or not t he Swit ch adds DHCP relay agent opt ion
82 inform at ion t o DHCP request s t hat t he Swit ch relays t o a DHCP server for each VLAN.
• Use t he D H CP Snoopin g VLAN Por t Configur e screen (
different DHCP opt ion 82 profile t o cert ain port s in a VLAN.
• Use t he ARP I n spe ct ion St a t us screen (
MAC address filt ers t hat were creat ed because t he Swit ch ident ified an unaut horized ARP packet .
• Use t he ARP I nspe ct ion VLAN St a t u s screen (
st at ist ics about ARP packet s in each VLAN.
C
HAPTER
Sect ion 26.2 on page
Sect ion 26.3 on page
Sect ion 26.4 on page
Sect ion 26.5 on page
Sect ion 26.6 on page
Sect ion 26.6.1 on page
Sect ion 26.6.2 on page
Sect ion 26.7 on page
Sect ion 26.8 on page
GS2210 Series User's Guide
222

IP Source Guard

223) t o display t he links t o t he
224) t o look at t he current
225) t o m anage st at ic
227) t o look at various st at ist ics about
230) t o enable DHCP
232) t o specify
234) t o enable DHCP
Sect ion 26.6.3 on page
236) t o look at t he current list of
237) t o look at various
2 6
235) t o apply a