Ipv4 Source Guard; Configuring Ports For Ipv4 Source Guard - Edge-Core ECS4110-28T Management Manual

IP 4 S G
V OURCE UARD
C
ONFIGURING
P IP 4
ORTS FOR V
S G
OURCE UARD
Figure 215: Protecting Against DoS Attacks
IPv4 Source Guard is a security feature that filters IP traffic on network
interfaces based on manually configured entries in the IP Source Guard
table, or dynamic entries in the DHCP Snooping table when enabled (see
"DHCP Snooping" on page
traffic attacks caused when a host tries to use the IP address of a neighbor
to access the network. This section describes how to configure IP Source
Guard.
Use the Security > IP Source Guard > Port Configuration page to set the
filtering type based on source IP address, or source IP address and MAC
address pairs.
IP Source Guard is used to filter traffic on an insecure port which receives
messages from outside the network or fire wall, and therefore may be
subject to traffic attacks caused by a host trying to use the IP address of a
neighbor.
CLI R
EFERENCES
◆ "ip source-guard" on page 938
C U
OMMAND SAGE
Setting source guard mode to SIP (Source IP) or SIP-MAC (Source IP
◆
and MAC) enables this function on the selected port. Use the SIP option
to check the VLAN ID, source IP address, and port number against all
entries in the binding table. Use the SIP-MAC option to check these
same parameters, plus the source MAC address. If no matching entry is
found, the packet is dropped.
– 401 –
C
HAPTER
412). IP source guard can be used to prevent
| Security Measures
13

IPv4 Source Guard