Ip Source Guard Configuration; Ip Source Guard Overview; Configuring A Static Binding Entry - H3C S5810 Series Operation Manual

Ethernet switches

Hide thumbs Also See for S5810 Series:

Table of Contents

IP Source Guard Configuration

When configuring IP Source Guard, go to these sections for information you are interested in:

Configuring Dynamic Binding Function

Displaying and Maintaining IP Source Guard

IP Source Guard Configuration Examples

Troubleshooting IP Source Guard

IP Source Guard Overview

By filtering packets on a per-port basis, IP source guard prevents illegal packets from traveling through

the ports, so as to block illegal usages of network resources and improve the network security. For

example, IP source guard can prevent an illegal host from pretending to be a legal user to access the

network. With IP source guard enabled on a port, after receiving a packet, the port looks up the key

attributes (including source IP address, source MAC address and VLAN tag) of the packet in the binding

entries of the IP source guard. If there is a match, the port forwards the packet. Otherwise, the port

discards the packet.

IP source guard filters packets based on the following types of binding entries:

IP-port binding entry

MAC-port binding entry

IP-MAC-port binding entry

IP-VLAN-port binding entry

MAC-VLAN-port binding entry

IP-MAC-VLAN-port binding entry

You can manually set static binding entries, or use DHCP snooping to provide dynamic binding entries,

where the dynamic IP-MAC bindings are inherited from the DHCP client IP-MAC bindings recorded by

DCHP snooping on an interface.

Binding is on a per-port basis. After a binding entry is configured on a port, it is effective only to the port.

Enabling IP source guard on a port is mutually exclusive with adding the port to an aggregation group.

Configuring a Static Binding Entry

Follow these steps to configure a static binding entry:

Table of Contents