Ip Source Guard - ZyXEL Communications XGS3700-48 User Manual

• DHCP snooping. Use this to filter unauthorized DHCP packets on the network and to build the
binding table dynamically.
• ARP inspection. Use this to filter unauthorized ARP packets on the network.
If you want to use dynamic bindings to filter unauthorized ARP packets (typical implementation),
you have to enable DHCP snooping before you enable ARP inspection.

25.2 IP Source Guard

Use this screen to look at the current bindings for DHCP snooping and ARP inspection. Bindings are
used by DHCP snooping and ARP inspection to distinguish between authorized and unauthorized
packets in the network. The Switch learns the bindings by snooping DHCP packets (dynamic
bindings) and from information provided manually by administrators (static bindings). To open this
screen, click Advanced Application > IP Source Guard.
Figure 181 IP Source Guard (Standalone mode)
Figure 182 IP Source Guard (Stacking mode)
The following table describes the labels in this screen.
Table 121 IP Source Guard
LABEL
IPv4 Source Guard
Setup
IPv6 Source Binding
Status (Standalone
mode)
IPv6 Static Binding
Setup (Standalone
mode)
IPv6 Source Guard
Policy Setup
(Standalone mode)
Chapter 25 IP Source Guard
DESCRIPTION
Click the link to open screens where you can view and manage static bindings,
configure DHCP snooping or ARP inspection and look at various statistics.
Click the link to open a screen where you can view the current IPv6 dynamic and static
bindings or remove dynamic bindings based on IPv6 address and/or IPv6 prefix.
Click the link to open a screen where you can manually create IPv6 source guard static
binding entries.
Click the link to open a screen where you can define policies to have IPv6 source guard
forward valid addresses and/or prefixes and allow or block data traffic from all link-
local addresses.
GS3700/XGS3700 Series User's Guide
267