Overview

IP Source Guard (IPSG) is a security feature implemented in network switches to mitigate IP address spoofing attacks. It generally works by ensuring that incoming packets on a network interface have a source IP address that matches an entry in the IP source guard binding table. Traffic from other IP addresses is dropped.

IP source guard binding table contains two types of entries: static entries and dynamic entries.

• Static entries: IP addresses that have been manually associated with a MAC address.

• Dynamic entries: IP addresses added through DHCP snooping binding table.

Dynamic table entry aging does not affect static table entries; that is to say, static table entries do not age.

IP source guard filtering items include either IP or IP+MAC based on specific interface and VLAN.

IP source guard permits traffic from the following sources, in addition to packets that match the entries in the IP source guard binding table:

• When DHCP snooping is enabled, IP source guard allows the reception of DHCP packets.

• IPv6 packets are not subjected to IP Source Guard checks.

By default, IP source guard is disabled. It must be enabled on each port where guarding is required.

Configuration Notes and Constraints

When configuring IP source guard, consider the following points:

• IP source guard can only be configured on Layer 2 physical ports.

• The interface that enables IPSG cannot be a DHCP snooping trust interface.

• IPSG has a higher priority than PBR (Policy-Based Routing) and 802.1X (downloadable ACL and dynamic ACL). When IPSG is enabled on the ingress interface and VLAN to which a packet belongs, the packet is subject to IPSG verification. As a result, it bypasses both PBR and 802.1X ACL matching processes.

• If a packet that matches the IP source guard entry also matches an ACL rule (such as a firewall filter ACL), and the action of the ACL rule is discard, then the packet will be discarded by the ACL regardless of other configurations.

• After configuring the IP source guard binding entry, it needs to be deployed to the hardware by the system. Therefore, the number of IP source guard binding entries supported by the switch depends on the current utilization of hardware resources. Of course, different switch platforms have different hardware performance, and thus support varying numbers of table entries.

• IPSG is not supported in MLAG scenarios.

Configuring IP Source Guard

Configuring IP Source Guard involves the following steps:

1. Configure IP Source Guard binding table entries in the following two ways:

• Static entries: Manually associate IP addresses with a MAC address.

• Enable DHCP snooping function to generate dynamic IP Source Guard entries. Dynamic entries are added through the DHCP Snooping binding table.

2. Enable IP source guard for a specific interface and VLAN.

3. (Optional) Configure IP source guard filtering item for a specific interface and VLAN.

4. Verify the IP source guard entries.

You can enable both static and dynamic entries for IP source guard, or you can choose to enable only one of them. For users with dynamically assigned IP addresses, enabling DHCP Snooping is necessary.

Configure Static IP Source Guard Binding Entry

Step 1          Configure static IP source guard entries.

Step 2          Enable IP source guard based on specific interface and VLAN. Here, the interface and VLAN ID should be consistent with the values configured in the static IP source guard entries.

Step 3          (Optional) Configure IP source guard filtering item based on specific interface and VLAN.

Step 4          Commit the configuration.

Step 5          View the IP source guard binding entries.

Configure Dynamic IP Source Guard Binding Entry

Step 1          Enable DHCP snooping.

Step 2          Enable IP source guard based on specific interface and VLAN. Here, the interface and VLAN ID is the one that enables DHCP snooping.

Step 3          (Optional) Configure IP source guard filtering item based on specific interface and VLAN. Here, the VLAN is the one that enables DHCP snooping.

Step 4          Commit the configuration.

Step 5          View the IP source guard binding entries.

Configuration Example

Networking Requirements

Figure 1.     IP Source Guard Configuration Example

Open

As shown in Figure 1, on interfaces ge-1/1/1 and ge-1/1/2 of the device named Switch, enable IP Source Guard function to prevent IP address spoofing attacks. Enable both static IP source guard binding entry configuration and dynamic entry originating from the DHCP snooping binding table.

Follow the configuration roadmap below to complete the deployment on the Switch device:

1. Configure IP source guard binding table static entries for host A.

2. Enable DHCP Snooping for dynamically assigning IP to host B.

3. Enable IP source guard function for interfaces ge-1/1/1 and ge-1/1/2.

4. Configure IP source guard filtering item based on specific interface and VLAN.

5. Check the IP source guard entries.

Procedure

Step 1          Configure VLAN.

Step 2          Configure IP source guard static entry for host A.

Step 3          For users with dynamically assigned IP addresses, DHCP snooping needs to be configured.

Step 4          Enable IP source guard.

Step 5          Configure IP source guard filtering item based on specific interface and VLAN.

Step 6          Commit the configuration.

Step 7          View the IP source guard binding entries.