Dynamic Ipv4 Source Guard Using Dhcp Snooping Configuration Example - HP 3600 v2 Series Configuration Manual

# Configure the IPv4 source guard feature on Ethernet 1/0/1 to filter packets based on the source
IP address.
[DeviceB] interface ethernet 1/0/1
[DeviceB-Ethernet1/0/1] ip verify source ip-address
# Configure Ethernet 1/0/1 to allow only IP packets with the source IP address of 192.168.0.2
to pass.
[DeviceB-Ethernet1/0/1] ip source binding ip-address 192.168.0.2
[DeviceB-Ethernet1/0/1] quit
Verifying the configuration
# Display information about static IPv4 source guard binding entries on Device A. The output shows that
the static IPv4 source guard binding entries are configured successfully.
[DeviceA] display ip source binding static
Total entries found: 2
MAC Address
0001-0203-0405
0001-0203-0406
# Display information about static IPv4 source guard binding entries on Device B. The output shows that
the static IPv4 source guard binding entries are configured successfully.
[DeviceB] display ip source binding static
Total entries found: 2
MAC Address
0001-0203-0406
N/A
Dynamic IPv4 source guard using DHCP snooping
configuration example
Network requirements
As shown in
Enable DHCP snooping on the device to record the DHCP snooping entry of the host. Enable the IPv4
source guard feature on the device's port Ethernet 1/0/1 to filter packets based on the DHCP snooping
entry, allowing only packets from clients that obtain IP addresses through the DHCP server to pass.
For information about DHCP server configuration, see Layer 3—IP Services Configuration Guide.
Figure 110 Network diagram
Configuration procedure
1. Configure DHCP snooping.
# Enable DHCP snooping.
<Device> system-view
IP Address
192.168.0.3
192.168.0.1
IP Address
192.168.0.1
192.168.0.2
Figure 1 10, the host obtains an IP address from the DHCP server.
VLAN Interface
N/A Eth1/0/2
N/A Eth1/0/1
VLAN Interface
N/A Eth1/0/2
N/A Eth1/0/1
364
Type
Static
Static
Type
Static
Static