Configuring Ip Source Guard For Trunk Ports - Cisco Nexus 9000 Series Configuration Manual

Configuring IP Source Guard
Command or Action
Step 2 [no] ip source binding ip-address mac-address vlan vlan-id
interface interface-type slot/port
Example:
switch(config)# ip source binding 10.5.22.17
001f.28bd.0013 vlan 100 interface ethernet 2/3
Step 3 (Optional) show ip dhcp snooping binding [interface
interface-type slot/port]
Example:
switch(config)# show ip dhcp snooping binding
interface ethernet 2/3
Step 4 (Optional) copy running-config startup-config
Example:
switch(config)# copy running-config startup-config

Configuring IP Source Guard for Trunk Ports

When IP Source Guard is configured on a port, traffic coming on that port will be dropped unless there is a
DHCP snooping entry to allow it in the TCAM. However, when IP Source Guard is configured on trunk ports
and you do not want traffic coming on certain VLANs to undergo this check (even if DHCP snooping is not
enabled on them), you can specify a list of VLANs to exclude.
Before you begin
Make sure that the DHCP feature and DHCP snooping are enabled.
SUMMARY STEPS
1. configure terminal
2. [no] ip dhcp snooping ipsg-excluded vlan vlan-list
3. (Optional) show ip ver source [ethernet slot/port | port-channel channel-number]
4. (Optional) copy running-config startup-config
DETAILED STEPS
Command or Action
Step 1 configure terminal
Example:
switch# configure terminal
switch(config)#
Step 2 [no] ip dhcp snooping ipsg-excluded vlan vlan-list
Example:
switch(config)# ip dhcp snooping ipsg-excluded vlan
1001-1256,3097
Purpose
Creates a static IP source entry for the current interface.
The no form of this command removes the static IP source
entry.
Displays IP-MAC address bindings for the interface
specified, including static IP source entries. Static entries
appear with the term in the Type column.
Copies the running configuration to the startup
configuration.
Purpose
Enters global configuration mode.
Specifies the list of VLANs to exclude from the DHCP
snooping check for IP Source Guard on trunk ports.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
Configuring IP Source Guard for Trunk Ports
409