Configuring Ip Source Guard; Overview; Static Ipsg Bindings - HPE FlexNetwork 7500 Series Security Configuration Manual

Configuring IP source guard

Overview

IP source guard (IPSG) prevents spoofing attacks by using an IPSG binding table to match
legitimate packets. It drops all packets that do not match the table. IPSG is a per-interface packet
filter. The feature configured on one interface does not affect packet forwarding on another interface.
The IPSG binding table can include the following bindings:
•
IP-interface.
•
MAC-interface.
•
IP-MAC-interface.
•
IP-VLAN-interface.
•
MAC-VLAN-interface.
•
IP-MAC-VLAN-interface.
IPSG bindings include static bindings that are configured manually and dynamic bindings that are
generated based on information from other modules. For more information about dynamic bindings,
see "Dynamic IPSG bindings."
As shown in
Figure 103 Diagram for the IPSG feature
Valid host
1.1.1.1
Invalid host

Static IPSG bindings

Static IPSG bindings are configured manually. They are suitable for scenarios where few hosts exist
on a LAN and their IP addresses are manually configured. For example, you can configure a static
IPSG binding on an interface that connects to a server. This binding allows the interface to receive
packets only from the server.
Static IPSG bindings on an interface implements the following functions:
•
Filter incoming IPv4 or IPv6 packets on the interface.
•
Cooperate with ARP detection in IPv4 and ND detection in IPv6 for user validity checking.
For information about ARP detection, see
Figure 103, IPSG forwards only the packets that match one of the IPSG bindings.
IPSG bindings
1.1.1.1
...
Configure the IP source guard
feature on the interface
IP network
"Configuring ARP attack
337
protection."