Table of Contents
Advertisement
Chapter 21
Configuring DHCP Features and IP Source Guard
Table 21-2 show ip dhcp snooping binding Command Output
Field
MacAddress
IpAddress
Lease(sec)
Type
VLAN
Interface
This example shows how to display the DHCP snooping binding database status and statistics:
Switch# show ip dhcp snooping database
Agent URL :
Write delay Timer : 300 seconds
Abort Timer : 300 seconds
Agent Running : No
Delay Timer Expiry : Not Running
Abort Timer Expiry : Not Running
Last Succeded Time : None
Last Failed Time : None
Last Failed Reason : No failure recorded.
Total Attempts
Successful Transfers :
Successful Reads
Successful Writes
Media Failures
Understanding IP Source Guard
IP source guard is a security feature that restricts IP traffic on nonrouted, Layer 2 interfaces by filtering
traffic based on the DHCP snooping binding database and on manually configured IP source bindings.
You can use IP source guard to prevent traffic attacks caused when a host tries to use the IP address of
its neighbor.
You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. After IP
source guard is enabled on an interface, the switch blocks all IP traffic received on the interface, except
for DHCP packets allowed by DHCP snooping. A port access control list (ACL) is applied to the
interface. The port ACL allows only IP traffic with s a source IP address in the IP source binding table
and denies all other traffic.
The IP source binding table has bindings that are learned by DHCP snooping or are manually configured
(static IP source bindings). An entry in this table has an IP address, its associated MAC address, and its
associated VLAN number. The switch uses the IP source binding table only when IP source guard is
enabled.
IP source guard is supported only on Layer 2 ports, including access and trunk ports.You can configure
IP source guard with source IP address filtering or with source IP and MAC address filtering.
To use this feature, you must have the enhanced multilayer image (EMI) installed on your switch.
78-16180-02
Description
Client hardware MAC address
Client IP address assigned from the DHCP server
Remaining lease time for the IP address
Binding type
VLAN number of the client interface
Interface that connects to the DHCP client host
:
0
Startup Failures :
0
Failed Transfers :
:
0
Failed Reads
:
0
Failed Writes
:
0
Catalyst 3750 Switch Software Configuration Guide
Understanding IP Source Guard
0
0
:
0
:
0
21-15
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
