SMC Networks SMCGS10P-SMART Management Manual page 103

C G
ONFIGURING LOBAL AND
Use the IP Source Guard Configuration page to filter traffic on an insecure
port which receives messages from outside the network or fire wall, and
therefore may be subject to traffic attacks caused by a host trying to use
the IP address of a neighbor. IP Source Guard filters traffic type based on
the source IP address and MAC address pairs found in the DHCP Snooping
table, or based upon static entries configured in the IP Source Guard Table.
P
ATH
Configuration, Security, Network, IP Source Guard, Configuration
C U
OMMAND SAGE
When IP Source Guard is enabled globally and on a port, the switch
◆
checks the VLAN ID, source IP address, and port number against all
entries in the DHCP Snooping binding table and IP Source Guard Static
Table. If no matching entry is found, the packet is dropped.
Multicast addresses cannot be used by IP Source Guard.
N :
OTE
When enabled, traffic is filtered based upon dynamic entries learned via
◆
DHCP snooping (see
configured in the source guard binding table.
If IP source guard is enabled, an inbound packet's IP address will be
◆
checked against the binding table. If no matching entry is found, the
packet will be dropped.
Filtering rules are implemented as follows:
◆
If DHCP snooping is disabled (see
■
check the VLAN ID, source IP address, and port number. If a
matching entry is found in the binding table and the entry type is
static IP source guard binding, the packet will be forwarded.
If DHCP snooping is enabled, IP source guard will check the VLAN
■
ID, source IP address, and port number. If a matching entry is
found in the binding table and the entry type is static IP source
guard binding, or dynamic DHCP snooping binding, the packet will
be forwarded.
If IP source guard if enabled on an interface for which IP source
■
bindings have not yet been configured (neither by static
configuration in the IP source guard binding table nor dynamically
learned from DHCP snooping), the switch will drop all IP traffic on
that port, except for DHCP packets.
P
ARAMETERS
These parameters are displayed:
◆ Global Mode – Enables or disables IP Source Guard globally on the
switch. All configured ACEs will be lost when enabled.
(Default: Disabled)
– 103 –
C
HAPTER
P S
ORT ETTINGS FOR
"Configuring DHCP Snooping"), or static addresses
page 99), IP source guard will
| Configuring the Switch
4
Configuring Security
IP S G
OURCE UARD