Dell PowerConnect J-EX4200-24T Software Manual page 2673

Requirements
Overview and Topology
connected to untrusted access interfaces on the switch. You can enable the IP source
guard port security feature on J-EX Series switches to mitigate the effects of such attacks.
If IP source guard determines that a source IP address and a source MAC address in a
binding in an incoming packet are not valid, the switch does not forward the packet.
You can use IP source guard in combination with other J-EX Series switch features to
mitigate address-spoofing attacks on untrusted access interfaces. This example shows
two configuration scenarios:
Requirements on page 2601
Overview and Topology on page 2601
Configuring IP Source Guard with 802.1X Authentication, DHCP Snooping, and Dynamic
ARP Inspection on page 2602
Configuring IP Source Guard on a Guest VLAN on page 2604
Verification on page 2607
This example uses the following hardware and software components:
A J-EX4200-24T switch
A DHCP server to provide IP addresses to network devices on the switch
A RADIUS server to provide 802.1X authentication
Before you configure IP source guard for these scenarios, be sure you have:
Connected the DHCP server to the switch.
Connected the RADIUS server and configured user authentication on the RADIUS
server. See "Example: Connecting a RADIUS Server for 802.1X to a J-EX Series Switch"
on page 2267.
Configured the VLANs on the switch. See "Example: Setting Up Bridging with Multiple
VLANs for J-EX Series Switches" on page 1070 for detailed information about configuring
VLANs.
IP source guard checks the IP source address and MAC source address in a packet sent
from a host attached to an untrusted access interface on the switch. If IP source guard
determines that the packet header contains an invalid source IP address or source MAC
address, it ensures that the switch does not forward the packet—that is, the packet is
discarded.
When you configure IP source guard, you enable on it on one or more VLANs. IP source
guard applies its checking rules to untrusted access interfaces on those VLANs. By default,
on J-EX Series switches, access interfaces are untrusted and trunk interfaces are trusted.
IP source guard does not check packets that have been sent to the switch by devices
connected to either trunk interfaces or trusted access interfaces—that is, interfaces
Chapter 94: Examples: Port Security Configuration
2601