Understanding Ip Source Guard; Source Ip Address Filtering - Cisco Catalyst 3750-E Software Configuration Manual

Hide thumbs Also See for Catalyst 3750-E:

Table of Contents

Understanding IP Source Guard

IPSG is a security feature that restricts IP traffic on nonrouted, Layer 2 interfaces by filtering traffic

based on the DHCP snooping binding database and on manually configured IP source bindings. You can

use IP source guard to prevent traffic attacks if a host tries to use the IP address of its neighbor.

You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. After IPSG

is enabled on an interface, the switch blocks all IP traffic received on the interface except for DHCP

packets allowed by DHCP snooping. A port access control list (ACL) is applied to the interface. The port

ACL allows only IP traffic with a source IP address in the IP source binding table and denies all other

The port ACL takes precedence over any router ACLs or VLAN maps that affect the same interface.

The IP source binding table has bindings that are learned by DHCP snooping or are manually configured

(static IP source bindings). An entry in this table has an IP address, its associated MAC address, and its

associated VLAN number. The switch uses the IP source binding table only when IP source guard is

IPSG is supported only on Layer 2 ports, including access and trunk ports.You can configure IPSG with

source IP address filtering or with source IP and MAC address filtering.

These sections contain this information:

When IPSG is enabled with this option, IP traffic is filtered based on the source IP address. The switch

forwards IP traffic when the source IP address matches an entry in the DHCP snooping binding database

or a binding in the IP source binding table.

When a DHCP snooping binding or static IP source binding is added, changed, or deleted on an interface,

the switch modifies the port ACL by using the IP source binding changes and re-applies the port ACL to

the interface.

If you enable IPSG on an interface on which IP source bindings (dynamically learned by DHCP snooping

or manually configured) are not configured, the switch creates and applies a port ACL that denies all IP

traffic on the interface. If you disable IP source guard, the switch removes the port ACL from the

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

Source IP Address Filtering, page 22-16

Source IP and MAC Address Filtering, page 22-17

IP Source Guard for Static Hosts, page 22-17

Configuring DHCP Features and IP Source Guard

Show Quick Links

Table of Contents

Catalyst3560-e