Static Ipsg Bindings; Dynamic Ipsg Bindings - HP FlexFabric 5700 Series Security Configuration Manual

Static IPSG bindings

Static IPSG bindings are configured manually. They are suitable for scenarios where few hosts exist on a
LAN and their IP addresses are manually configured. For example, you can configure a static IPSG
binding on an interface that connects to a server. This binding allows the interface to receive packets only
from the server.
Static IPSG bindings on an interface implements the following functions:
Filter incoming IPv4 or IPv6 packets on the interface.
•
• Cooperate with ARP detection in IPv4 for user validity checking.
For information about ARP detection, see
Static IPSG bindings can be global or interface-specific. IPSG first uses the interface-specific bindings to
match packets. If no match is found, IPSG uses the global bindings.
Global static binding—Binds the IP address and MAC address in system view. The binding takes
•
effect on all interfaces to filter packets for user spoofing attack prevention.
• Interface-specific static binding—Binds the IP address, MAC address, VLAN, or any combination
of the items in interface view. The binding takes effect only on the interface to check the validity of
users who are attempting to access the interface.

Dynamic IPSG bindings

IPSG automatically obtains user information from other modules to generate dynamic bindings. The
source modules include DHCP relay, DHCP snooping, DHCPv6 snooping, and DHCP server.
DHCP-based IPSG bindings are suitable for scenarios where hosts on a LAN obtain IP addresses through
DHCP. IPSG is configured on the DHCP snooping device or the DHCP relay agent. It generates dynamic
IPSG bindings based on the DHCP snooping entries or DHCP relay entries. IPSG allows only packets
from the DHCP clients to pass through.
Dynamic IPv4SG
Dynamic bindings generated based on different source modules are for different usages:
Interface types
Layer 2 Ethernet port
VLAN interface
For information about DHCP snooping, DHCP relay, and DHCP server see Layer 3—IP Services
Configuration Guide.
Dynamic IPv6SG
IPv6SG on an interface obtains information from DHCPv6 snooping entries to generate bindings for
packet filtering.
For more information about DHCPv6 snooping, see Layer 3—IP Services Configuration Guide.
"Configuring ARP attack
Source modules
DHCP snooping
DHCP relay agent
DHCP server
347
protection."
Binding usage
Packet filtering.
Packet filtering.
For cooperation with modules (such as the
ARP detection module) to provide security
services.