Enabling Ip Source Guard On A Port; Defining Static Ip Source Bindings - Dell PowerConnect B-FCXs Configuration Manual

39
IP source guard
•
•
•
•
•

Enabling IP source guard on a port

You can enable IP Source Guard on DHCP snooping untrusted ports. Refer to
page 1349 for how to configure DHCP and DHCP untrusted ports.
By default, IP Source Guard is disabled. To enable IP Source Guard on a DHCP untrusted port, enter
the following commands.
PowerConnect(config)#interface ethernet 1/4
PowerConnect(config-if-e10000-1/4)#source-guard enable
The commands change the CLI to the interface configuration level for port 1/4 and enable IP
Source Guard on the port.
Syntax: [no] source-guard enable

Defining static IP source bindings

You can manually enter valid IP addresses in the binding database. To do so, enter a command
such as the following.
PowerConnect(config)#ip source binding 10.10.10.1 e 2/4 vlan 4
Syntax: [no] ip source binding <ip-addr> ethernet [<slotnum>/]<portnum> [vlan <vlannum>]
For <ip-addr>, enter a valid IP address.
The <slotnum> parameter is required on chassis devices.
The <portnum> parameter is a valid port number.
1362
The number of configured ACL rules affect the rate at which hardware resources are used
when IP Source Guard is enabled. Use the show access-list hw-usage on command to enable
hardware usage for an ACL, followed by a show access-list <access-list-id> command to
determine the hardware usage for an ACL.
Example
PowerConnect#show access-list hw-usage on
PowerConnect#show access-list 100
Extended IP access list 100 (hw usage : 2)
deny ip any any (hw usage : 1)
To provide more hardware resource for IP Source Guard addresses, modify the ACL rules so
that it uses less hardware resource.
If you enable IP Source Guard in a network topology that has DHCP clients, you must also
enable DHCP snooping. Otherwise, all IP traffic including DHCP packets will be blocked.
When you enable IP Source Guard in a network topology that does not have DHCP clients, you
must create an IP source binding for each client that will be allowed access to the network.
Otherwise, data packets will be blocked. Refer to
page 1362.
Source Guard Protection enables concurrent support with multi-device port authentication.
For details, Refer to "Enabling source guard protection"
IP Source Guard is supported on a VE with or without an assigned IP address.
"Defining static IP source bindings"
on page 1286.
"DHCP snooping"
PowerConnect B-Series FCX Configuration Guide
on
on
53-1002266-01