Configuring Dynamic Ipv4 Source Guard - HP 5120 SI Series Security Configuration Manual

To do...
Enter system view
Enter Layer 2 Ethernet interface
view
Configure a static IPv4 source
guard entry for the port
NOTE:
You cannot configure the same static binding entry on one port for multiple times, but you can configure
•
the same static entry on different ports.
In an IPv4 source guard entry, the MAC address cannot be all 0s, all Fs (a broadcast address), or a
•
multicast address, and the IPv4 address can only be a Class A, Class B, or Class C address and can be
neither 127.x.x.x nor 0.0.0.0.
When you configure a static binding entry, if its content is the same as that of a dynamic binding entry
•
in the system, the static binding entry overwrites the dynamic binding entry.

Configuring dynamic IPv4 source guard

After dynamic IPv4 source guard is enabled on a port, IP source guard will generate binding entries
dynamically through cooperation with DHCP protocols:
• On a Layer 2 Ethernet port, IP source guard cooperates with DHCP snooping, dynamically obtains
the DHCP snooping entries generated during dynamic IP address allocation, and generates IP
source guard entries accordingly.
On a VLAN interface, IP source guard cooperates with DHCP relay, dynamically obtains the DHCP
•
relay entries generated during dynamic IP address allocation across network segments, and
generates IP source guard entries accordingly.
Dynamic IPv4 source guard entries can contain such information as MAC address, IP address, VLAN tag,
ingress port information, and entry type (DHCP snooping or DHCP relay), where the MAC address, IP
address, or VLAN tag information may not be included depending on your configuration. IP source
guard applies these entries to the port to filter packets.
Follow these steps to configure dynamic IPv4 source guard:
To do...
Enter system view
Enter interface view
Configure dynamic IPv4 source
guard
Use the command...
system-view
interface interface-type
interface-number
user-bind ipv6 ip-address
ipv6-address [ mac-address
mac-address ] [vlan vlan-id ]
Use the command...
system-view
interface interface-type
interface-number
ip check source ipv6 ip-address
[ mac-address ]
292
Remarks
—
—
Required
No static IPv4 source guard entry
exists on a port by default.
Remarks
—
—
Required
Not configured by default