Configuring Ip Source Guard - Cisco Catalyst 4500 Series Software Configuration Manual

Configuring IP Source Guard

the client IP traffic to those source IP addresses configured in the binding; any IP traffic with a source
IP address other than that in the IP source binding is filtered out. This filtering limits the ability of a host
to attack the network by claiming a neighbor host's IP address.
Note If IP source guard is enabled on a trunk port with a large number of VLANs that have DHCP snooping
enabled, you might exhaust ACL hardware resources, and some packets might be switched in software
instead.
When IP source guard is enabled, you might want to designate an alternative scheme for ACL hardware
Note
programming. For more information, see the "TCAM Programming and ACLs" section in
"Configuring Network Security with
When an interface is in down state, TCAMs are consumed for PACLs, but not for RACLs.
Note
IP source guard supports the Layer 2 port only, including both access and trunk. For each untrusted Layer
2 port, there are two levels of IP traffic security filtering:
•
•
When IP source guard is enabled in IP and MAC filtering mode, the DHCP snooping Option 82 must be
Note
enabled to ensure that the DHCP protocol works properly. Without Option 82 data, the switch cannot
locate the client host port to forward the DHCP server reply. Instead, the DHCP server reply is dropped,
and the client cannot obtain an IP address.
Configuring IP Source Guard
To enable IP source guard, perform this task:
Command
Step 1
Switch(config)# ip dhcp snooping
Step 2
Switch(config)# ip dhcp snooping vlan number
[number]
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
60-20
Source IP address filter
IP traffic is filtered based on its source IP address. Only IP traffic with a source IP address that
matches the IP source binding entry is permitted.
An IP source address filter is changed when a new IP source entry binding is created or deleted on
the port. The port VACL is recalculated and reapplied in the hardware to reflect the IP source binding
change. By default, if the IP filter is enabled without any IP source binding on the port, a default
PVACL that denies all IP traffic is installed on the port. Similarly, when the IP filter is disabled, any
IP source filter PVACL is removed from the interface.
Source IP and MAC address filter
IP traffic is filtered based on its source IP address as well as its MAC address; only IP traffic with
source IP and MAC addresses matching the IP source binding entry are permitted.
Chapter 60 Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts
ACLs".
Purpose
Enables DHCP snooping globally.
You can use the no keyword to disable DHCP snooping.
Enables DHCP snooping on your VLANs.
Chapter 62,