LevelOne GEL-1061 User Manual page 309

Command Usage
Filter Type
◆
Setting source guard mode to SIP (Source IP) or SIP-MAC (Source IP and MAC)
enables this function on the selected port. Use the SIP option to check the
VLAN ID, source IP address, and port number against all entries in the binding
table. Use the SIP-MAC option to check these same parameters, plus the source
MAC address. If no matching entry is found, the packet is dropped.
Note: Multicast addresses cannot be used by IP Source Guard.
◆
When enabled, traffic is filtered based upon dynamic entries learned via DHCP
snooping (see "DHCP Snooping" on page
the source guard binding table.
◆
If IP source guard is enabled, an inbound packet's IP address (SIP option) or
both its IP address and corresponding MAC address (SIP-MAC option) will be
checked against the binding table. If no matching entry is found, the packet
will be dropped.
◆
An entry with same MAC address and a different VLAN ID cannot be added to
the binding table.
◆
Filtering rules are implemented as follows:
If DHCP snooping is disabled (see
■
VLAN ID, source IP address, port number, and source MAC address (for the
SIP-MAC option). If a matching entry is found in the binding table and the
entry type is static IP source guard binding, the packet will be forwarded.
If DHCP snooping is enabled, IP source guard will check the VLAN ID, source
■
IP address, port number, and source MAC address (for the SIP-MAC option).
If a matching entry is found in the binding table and the entry type is static
IP source guard binding, or dynamic DHCP snooping binding, the packet
will be forwarded.
If IP source guard is enabled on an interface for which IP source bindings
■
have not yet been configured (neither by static configuration in the IP
source guard binding table nor dynamically learned from DHCP snooping),
the switch will drop all IP traffic on that port, except for DHCP packets
allowed by DHCP snooping.
Parameters
These parameters are displayed:
◆
Filter Type – Configures the switch to filter inbound traffic based source IP
address, or source IP address and corresponding MAC address. (Default: None)
Disabled – Disables IP source guard filtering on the port.
■
299), or static addresses configured in
page
– 309 –
Chapter 12
| Security Measures
IPv4 Source Guard
302), IP source guard will check the