Understanding Ip Source Guard; Source Ip Address Filtering; Source Ip And Mac Address Filtering - Cisco Catalyst 2975 Software Configuration Manual

Chapter 20 Configuring DHCP Features and IP Source Guard Features

Understanding IP Source Guard

IPSG is a security feature that restricts IP traffic on nonrouted, Layer 2 interfaces by filtering traffic
based on the DHCP snooping binding database and on manually configured IP source bindings. You can
use IP source guard to prevent traffic attacks if a host tries to use the IP address of its neighbor.
You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. After IPSG
is enabled on an interface, the switch blocks all IP traffic received on the interface except for DHCP
packets allowed by DHCP snooping. A port access control list (ACL) is applied to the interface. The
port ACL allows only IP traffic with a source IP address in the IP source binding table and denies all
other traffic.
The port ACL takes precedence over any router ACLs or VLAN maps that affect the same interface.
Note
The IP source binding table bindings are learned by DHCP snooping or are manually configured (static
IP source bindings). An entry in this table has an IP address with its associated MAC address and VLAN
number. The switch uses the IP source binding table only when IP source guard is enabled.
IPSG is supported only on Layer 2 ports, including access and trunk ports.You can configure IPSG with
source IP address filtering or with source IP and MAC address filtering.
•
•
•

Source IP Address Filtering

When IPSG is enabled with this option, IP traffic is filtered based on the source IP address. The switch
forwards IP traffic when the source IP address matches an entry in the DHCP snooping binding database
or a binding in the IP source binding table.
When a DHCP snooping binding or static IP source binding is added, changed, or deleted on an interface,
the switch modifies the port ACL by using the IP source binding changes and re-applies the port ACL
to the interface.
If you enable IPSG on an interface on which IP source bindings (dynamically learned by DHCP
snooping or manually configured) are not configured, the switch creates and applies a port ACL that
denies all IP traffic on the interface. If you disable IP source guard, the switch removes the port ACL
from the interface.

Source IP and MAC Address Filtering

IP traffic is filtered based on the source IP and MAC addresses. The switch forwards traffic only when
the source IP and MAC addresses match an entry in the IP source binding table.
When address filtering is enabled, the switch filters IP and non-IP traffic. If the source MAC address of
an IP or non-IP packet matches a valid IP source binding, the switch forwards the packet. The switch
drops all other types of packets except DHCP packets.
The switch uses port security to filter source MAC addresses. The interface can shut down when a
port-security violation occurs.
OL-19720-02
Source IP Address Filtering, page 20-15
Source IP and MAC Address Filtering, page 20-15
IP Source Guard for Static Hosts, page 20-16
Understanding IP Source Guard
Catalyst 2975 Switch Software Configuration Guide
20-15