Enabling Ip Source Guard - Cisco IE-4000 Software Configuration Manual

Configuring IP Source Guard
How to Configure IP Source Guard

When IP source guard with source IP filtering is enabled on an interface, DHCP snooping must be enabled on the
access VLAN for that interface.

If you are enabling IP source guard on a trunk interface with multiple VLANs and DHCP snooping is enabled on all
the VLANs, the source IP address filter is applied on all the VLANs.
If IP source guard is enabled and you enable or disable DHCP snooping on a VLAN on the trunk interface, the
switch might not properly filter traffic.

If you enable IP source guard with source IP and MAC address filtering, DHCP snooping and port security must be
enabled on the interface. You must also enter the ip dhcp snooping information option global configuration
command and ensure that the DHCP server supports option 82. When IP source guard is enabled with MAC address
filtering, the DHCP host MAC address is not learned until the host is granted a lease. When forwarding packets from
the server to the host, DHCP snooping uses option-82 data to identify the host port.

When configuring IP source guard on interfaces on which a private VLAN is configured, port security is not
supported.

IP source guard is not supported on EtherChannels.

You can enable this feature when 802.1x port-based authentication is enabled.

If the number of ternary content addressable memory (TCAM) entries exceeds the maximum, the CPU usage
increases.
How to Configure IP Source Guard

Enabling IP Source Guard

Command
1. configure terminal
2. interface interface-id
3. ip verify source
or
ip verify source port-security
Purpose
Enters global configuration mode.
Specifies the interface to be configured, and enters interface
configuration mode.
Enables IPSG with source IP address filtering.
Enables IPSG with source IP and MAC address filtering.
Note: When you enable both IPSG and port security by using the ip verify
source port-security interface configuration command, there are two
caveats:
• The DHCP server must support option-82, or the client is not
assigned an IP address.
• The MAC address in the DHCP packet is not learned as a secure
address. The MAC address of the DHCP client is learned as a
secure address only when the switch receives non-DHCP data
traffic.
419