Ip Source Guard; Chapter 25 Ip Source Guard; Overview; What You Can Do - ZyXEL Communications GS2210 Series User Manual

25.1 Overview

Use IP source guard to filter unauthorized DHCP and ARP packets in your network.
IP source guard uses a binding table to distinguish between authorized and unauthorized DHCP and
ARP packets in your network. A binding contains these key attributes:
• MAC address
• VLAN ID
• IP address
• Port number
When the Switch receives a DHCP or ARP packet, it looks up the appropriate MAC address, VLAN ID,
IP address, and port number in the binding table. If there is a binding, the Switch forwards the
packet. If there is not a binding, the Switch discards the packet.

25.1.1 What You Can Do

• Use the IP Source Guard screen
DHCP snooping and ARP inspection.
• Use the IP Source Guard Static Binding screen
bindings for DHCP snooping and ARP inspection.
• Use the DHCP Snooping screen
the DHCP snooping database.
• Use this DHCP Snooping Configure screen
snooping on the Switch (not on specific VLAN), specify the VLAN where the default DHCP server
is located, and configure the DHCP snooping database.
• Use the DHCP Snooping Port Configure screen
whether ports are trusted or untrusted ports for DHCP snooping.
• Use the DHCP VLAN Configure screen
on each VLAN and to specify whether or not the Switch adds DHCP relay agent option 82
information to DHCP requests that the Switch relays to a DHCP server for each VLAN.
• Use the DHCP Snooping VLAN Port Configure screen
different DHCP option 82 profile to certain ports in a VLAN.
• Use the ARP Inspection Status screen
MAC address filters that were created because the Switch identified an unauthorized ARP packet.
• Use the ARP Inspection VLAN Status screen
statistics about ARP packets in each VLAN.
• Use the ARP Inspection Log Status screen
that were generated by ARP packets and that have not been sent to the syslog server yet.
C
HAPTER
(Section 25.2 on page
(Section 25.3 on page
(Section 25.4 on page
(Section 25.5 on page
(Section 25.5.1 on page
(Section 25.5.2 on page
(Section 25.6 on page
(Section 25.7 on page
(Section 25.8 on page
GS2210 Series User's Guide
203

IP Source Guard

204) to look at the current bindings for
205) to manage static
206) to look at various statistics about
209) to enable DHCP
211) to specify
213) to enable DHCP snooping
(Section 25.5.3 on page
215) to look at the current list of
216) to look at various
216) to look at log messages
2 5
213) to apply a