Configuring Ip Source Guard; Source Ip Address Filtering - Cisco IE-4000 Software Configuration Manual

Configuring IP Source Guard

Prerequisites for IP Source Guard

You must globally configure the ip device tracking maximum limit-number interface configuration command
globally for IPSG for static hosts to work. If you only configure this command on a port without enabling IP device
tracking globally or setting an IP device tracking maximum on that interface, IPSG with static hosts will reject all the
IP traffic from that interface. This requirement also applies to IPSG with static hosts on a Layer 2 access port.
Restrictions for IP Source Guard

To use this feature, the switch must be running the LAN Base image.

IP source guard (IPSG) is supported only on Layer 2 ports, including access and trunk ports.

Do not use IPSG for static hosts on uplink ports or trunk ports.
Information About IP Source Guard
IP Source Guard
IPSG is a security feature that restricts IP traffic on nonrouted, Layer 2 interfaces by filtering traffic based on the DHCP
snooping binding database and on manually configured IP source bindings. You can use IPSG to prevent traffic attacks
if a host tries to use the IP address of its neighbor.
You can enable IPSG when DHCP snooping is enabled on an untrusted interface. After IPSG is enabled on an interface,
the switch blocks all IP traffic received on the interface except for DHCP packets allowed by DHCP snooping. A port
access control list (ACL) is applied to the interface. The port ACL allows only IP traffic with a source IP address in the IP
source binding table and denies all other traffic.
Note: The port ACL takes precedence over any router ACLs or VLAN maps that affect the same interface.
The IP source binding table bindings are learned by DHCP snooping or are manually configured (static IP source
bindings). An entry in this table has an IP address with its associated MAC address and VLAN number. The switch uses
the IP source binding table only when IPSG is enabled.
You can configure IPSG with source IP address filtering or with source IP and MAC address filtering.

Source IP Address Filtering

When IPSG is enabled with this option, IP traffic is filtered based on the source IP address. The switch forwards IP traffic
when the source IP address matches an entry in the DHCP snooping binding database or a binding in the IP source
binding table.
When a DHCP snooping binding or static IP source binding is added, changed, or deleted on an interface, the switch
modifies the port ACL by using the IP source binding changes and re-applies the port ACL to the interface.
Cisco Systems, Inc. www.cisco.com
417