Edge-Core ECS3510-26P Management Manual page 355

If DHCP snooping is enabled, IP source guard will check the VLAN
■
ID, source IP address, port number, and source MAC address (for
the SIP-MAC option). If a matching entry is found in the binding
table and the entry type is static IP source guard binding, or
dynamic DHCP snooping binding, the packet will be forwarded.
If IP source guard if enabled on an interface for which IP source
■
bindings have not yet been configured (neither by static
configuration in the IP source guard binding table nor dynamically
learned from DHCP snooping), the switch will drop all IP traffic on
that port, except for DHCP packets.
P
ARAMETERS
These parameters are displayed:
Filter Type – Configures the switch to filter inbound traffic based
◆
source IP address, or source IP address and corresponding MAC
address. (Default: None)
None – Disables IP source guard filtering on the port.
■
SIP – Enables traffic filtering based on IP addresses stored in the
■
binding table.
SIP-MAC – Enables traffic filtering based on IP addresses and
■
corresponding MAC addresses stored in the binding table.
Max Binding Entry – The maximum number of entries that can be
◆
bound to an interface. (Range: 1-5; Default: 5)
This parameter sets the maximum number of address entries that can
be mapped to an interface in the binding table, including both dynamic
entries discovered by DHCP snooping (see
page 359) and static entries set by IP source guard (see
Static Bindings for IP Source Guard" on page
W I
EB NTERFACE
To set the IP Source Guard filter for ports:
Click Security, IP Source Guard, Port Configuration.
1.
Set the required filtering type for each port.
2.
Click Apply
3.
– 355 –
| Security Measures
C 13
HAPTER
IP Source Guard
"DHCP Snooping" on
"Configuring
356).