Filter
Top Products
20-15
Catalyst 2960 and 2960-S Switch Software Configuration Guide
OL-8603-09
Chapter 20 Configuring DHCP Features and IP Source Guard Features
Understanding IP Source Guard
Source IP Address Filtering
When IPSG is enabled with this option, IP traffic is filtered based on the source IP address. The switch
forwards IP traffic when the source IP address matches an entry in the DHCP snooping binding database
or a binding in the IP source binding table.
When a DHCP snooping binding or static IP source binding is added, changed, or deleted on an interface,
the switch modifies the port ACL by using the IP source binding changes and re-applies the port ACL to
the interface.
If you enable IPSG on an interface on which IP source bindings (dynamically learned by DHCP snooping
or manually configured) are not configured, the switch creates and applies a port ACL that denies all IP
traffic on the interface. If you disable IP source guard, the switch removes the port ACL from the
interface.
Source IP and MAC Address Filtering
IP traffic is filtered based on the source IP and MAC addresses. The switch forwards traffic only when
the source IP and MAC addresses match an entry in the IP source binding table.
When address filtering is enabled, the switch filters IP and non-IP traffic. If the source MAC address of
an IP or non-IP packet matches a valid IP source binding, the switch forwards the packet. The switch
drops all other types of packets except DHCP packets.
The switch uses port security to filter source MAC addresses. The interface can shut down when a
port-security violation occurs.
IP Source Guard for Static Hosts
Note Do not use IPSG (IP source guard) for static hosts on uplink ports or trunk ports.
IPSG for static hosts extends the IPSG capability to non-DHCP and static environments. The previous
IPSG used the entries created by DHCP snooping to validate the hosts connected to a switch. Any traffic
received from a host without a valid DHCP binding entry is dropped. This security feature restricts IP
traffic on nonrouted Layer 2 interfaces. It filters traffic based on the DHCP snooping binding database
and on manually configured IP source bindings. The previous version of IPSG required a DHCP
environment for IPSG to work.
IPSG for static hosts allows IPSG to work without DHCP. IPSG for static hosts relies on IP device
tracking-table entries to install port ACLs. The switch creates static entries based on ARP requests or
other IP packets to maintain the list of valid hosts for a given port. You can also specify the number of
hosts allowed to send traffic to a given port. This is equivalent to port security at Layer 3.
IPSG for static hosts also supports dynamic hosts. If a dynamic host receives a DHCP-assigned IP
address that is available in the IP DHCP snooping table, the same entry is learned by the IP device
tracking table. In a stacked environment, when the master failover occurs, the IP source guard entries for
static hosts attached to member ports are retained. When you enter the show ip device tracking all
EXEC command, the IP device tracking table displays the entries as ACTIVE.