Filter
Top Products
20-20
Catalyst 2960 and 2960-S Switch Software Configuration Guide
OL-8603-09
Chapter 20 Configuring DHCP Features and IP Source Guard Features
Configuring IP Source Guard
This example shows how to enable IPSG for static hosts with IP filters on a Layer 2 access port and to
verify the valid IP bindings on the interface Gi0/3:
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip device tracking
Switch(config)# interface gigabitethernet 0/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# ip device tracking maximum 5
Switch(config-if)# ip verify source tracking
Switch(config-if)# end
Switch# show ip verify source
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- ----------------- ----
Gi0/3 ip trk active 40.1.1.24 10
Gi0/3 ip trk active 40.1.1.20 10
Gi0/3 ip trk active 40.1.1.21 10
This example shows how to enable IPSG for static hosts with IP-MAC filters on a Layer 2 access port,
to verify the valid IP-MAC bindings on the interface Gi0/3, and to verify that the number of bindings on
this interface has reached the maximum:
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip device tracking
Switch(config)# interface gigabitethernet 0/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 1
Switch(config-if)# ip device tracking maximum 5
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 5
Switch(config-if)# ip verify source tracking port-security
Switch(config-if)# end
Switch# show ip verify source
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- ----------------- ----
Gi0/3 ip-mac trk active 40.1.1.24 00:00:00:00:03:04 1
Gi0/3 ip-mac trk active 40.1.1.20 00:00:00:00:03:05 1
Gi0/3 ip-mac trk active 40.1.1.21 00:00:00:00:03:06 1
Gi0/3 ip-mac trk active 40.1.1.22 00:00:00:00:03:07 1
Gi0/3 ip-mac trk active 40.1.1.23 00:00:00:00:03:08 1
This example displays all IP or MAC binding entries for all interfaces. The CLI displays all active as
well as inactive entries. When a host is learned on a interface, the new entry is marked as active. When
the same host is disconnected from that interface and connected to a different interface, a new IP or MAC
binding entry displays as active as soon as the host is detected. The old entry for this host on the previous
interface is marked as INACTIVE.
Switch# show ip device tracking all
IP Device Tracking = Enabled
IP Device Tracking Probe Count = 3
IP Device Tracking Probe Interval = 30
---------------------------------------------------------------------
IP Address MAC Address Vlan Interface STATE
---------------------------------------------------------------------
200.1.1.8 0001.0600.0000 8 GigabitEthernet0/1 INACTIVE
200.1.1.9 0001.0600.0000 8 GigabitEthernet0/1 INACTIVE
200.1.1.10 0001.0600.0000 8 GigabitEthernet0/1 INACTIVE
200.1.1.1 0001.0600.0000 9 GigabitEthernet0/2 ACTIVE
200.1.1.1 0001.0600.0000 8 GigabitEthernet0/1 INACTIVE