Ip Source Guard; Ip Source Guard Port Configuration - Digisol DG-FS4526 Management Manual

Mustang 4000 switch series
Table of Contents

Advertisement

CLI – This example shows how to enable the DHCP Snooping Trust Status for ports
Console(config)#interface ethernet 1/5
Console(config-if)#ip dhcp snooping trust
Console(config-if)#

IP Source Guard

IP Source Guard is a security feature that filters IP traffic on network interfaces
based on manually configured entries in the IP Source Guard table, or static and
dynamic entries in the DHCP Snooping table when enabled (see "DHCP Snooping"
on page 3-227). IP source guard can be used to prevent traffic attacks caused when
a host tries to use the IP address of a neighbor to access the network. This section
describes commands used to configure IP Source Guard.

IP Source Guard Port Configuration

IP Source Guard is used to filter traffic on an unsecure port which receives
messages from outside the network or firewall, and therefore may be subject to
traffic attacks caused by a host trying to use the IP address of a neighbor.
When enabled, traffic is filtered based upon dynamic entries learned via DHCP
snooping or static addresses configured in the source guard binding table. An
inbound packet's IP address (sip option) or both its IP address and corresponding
MAC address (sip-mac option) are checked against the binding table. If no matching
entry is found, the packet is dropped.
Command Attributes
• Filter Type – Configures the switch to filter inbound traffic based source IP
address, or source IP address and corresponding MAC address. (Default: None)
• None – Disables IP source guard filtering on the port.
• SIP – Enables traffic filtering based on IP addresses stored in the binding table.
• SIP-MAC – Enables traffic filtering based on IP addresses and corresponding
MAC addresses stored in the binding table.
www.digisol.com
DG-FS4526 User Manual
3
.
4-306
3-231

Hide quick links:

Advertisement

Table of Contents
loading

Table of Contents