Source Ip Address Filtering; Source Ip And Mac Address Filtering; Configuring Ip Source Guard; Default Ip Source Guard Configuration - Cisco IE-3000-8TC Software Configuration Manual

Chapter 23 Configuring DHCP Features and IP Source Guard

Source IP Address Filtering

When IP source guard is enabled with this option, IP traffic is filtered based on the source IP address.
The switch forwards IP traffic when the source IP address matches an entry in the DHCP snooping
binding database or a binding in the IP source binding table.
When a DHCP snooping binding or static IP source binding is added, changed, or deleted on an interface,
the switch modifies the port ACL using the IP source binding changes, and re-applies the port ACL to
the interface.
If you enable IP source guard on an interface on which IP source bindings (dynamically learned by
DHCP snooping or manually configured) are not configured, the switch creates and applies a port ACL
that denies all IP traffic on the interface. If you disable IP source guard, the switch removes the port ACL
from the interface.

Source IP and MAC Address Filtering

When IP source guard is enabled with this option, IP traffic is filtered based on the source IP and MAC
addresses. The switch forwards traffic only when the source IP and MAC addresses match an entry in
the IP source binding table.
When IP source guard with source IP and MAC address filtering is enabled, the switch filters IP and
non-IP traffic. If the source MAC address of an IP or non-IP packet matches a valid IP source binding,
the switch forwards the packet. The switch drops all other types of packets except DHCP packets.
The switch uses port security to filter source MAC addresses. The interface can shut down when a
port-security violation occurs.

Configuring IP Source Guard

These sections contain this configuration information:
•
•
•

Default IP Source Guard Configuration

By default, IP source guard is disabled.

IP Source Guard Configuration Guidelines

•
•
OL-13018-03
Default IP Source Guard Configuration, page 23-13
IP Source Guard Configuration Guidelines, page 23-13
Enabling IP Source Guard, page 23-14
You can configure static IP bindings only on nonrouted ports. If you enter the ip source binding
mac-address vlan vlan-id ip-address interface interface-id global configuration command on a
routed interface, this error message appears:
Static IP source binding can only be configured on switch port.
When IP source guard with source IP filtering is enabled on an interface, DHCP snooping must be
enabled on the access VLAN to which the interface belongs.
Cisco IE 3000 Switch Software Configuration Guide
Configuring IP Source Guard
23-13