Brocade Communications Systems 6650 Defining static IP source bindings, No source-guard enable

Syntax:

Enabling IP source guard on a port

You can enable IP Source Guard on DHCP snooping untrusted ports. Refer to “DHCP snooping” on page 283 for how to configure DHCP and DHCP untrusted ports.

By default, IP Source Guard is disabled. To enable IP Source Guard on a DHCP untrusted port, enter the following commands.

Brocade(config)# interface ethernet 1/1/4 Brocade(config-if-e10000-1/1/4)#source-guard enable

The commands change the CLI to the interface configuration level for port 1/1/4 and enable IP Source Guard on the port.

Brocade# show access-listhw-usage on Brocade# show access-list 100

Extended IP access list 100 (hw usage : 2)

deny ip any any (hw usage : 1)

To provide more hardware resource for IP Source Guard addresses, modify the ACL rules so that it uses less hardware resource.

IP source guard

• 64 rules per ACL

•The number of configured ACL rules affect the rate at which hardware resources are used when IP Source Guard is enabled. Use the show access-listhw-usage on command to enable hardware usage for an ACL, followed by a show access-list access-list-idcommand to determine the hardware usage for an ACL.

Example

•If you enable IP Source Guard in a network topology that has DHCP clients, you must also enable DHCP snooping. Otherwise, all IP traffic including DHCP packets will be blocked.

•When you enable IP Source Guard in a network topology that does not have DHCP clients, you must create an IP source binding for each client that will be allowed access to the network. Otherwise, data packets will be blocked. Refer to “Defining static IP source bindings” on page 296.

•Source Guard Protection enables concurrent support with multi-device port authentication. For details, Refer to “Enabling source guard protection” on page 246.

•IP Source Guard is supported on a VE with or without an assigned IP address.

[no] source-guard enable

Defining static IP source bindings

You can manually enter valid IP addresses in the binding database. To do so, enter a command such as the following.

Brocade(config)# ip source binding 10.10.10.1 ethernet 1/2/4 vlan 4

Syntax: [no] ip source binding ip-addrethernet stack-iunit/slotnum/portnum[vlan vlannum]

For ip-addr, enter a valid IP address.

296	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01