21-16
Cisco Catalyst Blade Switch 3130 for Dell Software Configuration Guide
OL-13270-01
Chapter21 Configuring DHCP Features and IP Source Guard
Understanding IP Source Guard
Note If DHCP snooping is enabled and an interface changes to the down state, the switch does not delete the
statically configured bindings.
Understanding IP Source Guard
IP source guard is a security feature that restricts IP traffic on nonro uted, Layer 2 interfaces by filtering
traffic based on the DHCP snooping binding database and on manually configured I P so urce bin dings.
You can use IP source guard to prevent traffic attacks caused when a host tries to use the IP address of
its neighbor.
You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. After IP
source guard is enabled on an interface, the switch blocks all IP traffic received on the interface, except
for DHCP packets allowed by DHCP snooping. A port access control list (ACL) is applied to the
interface. The port ACL allows only IP traf f ic with a source IP addres s in the IP source binding t able and
denies all other traffic.
Note As with all port ACLs, this port ACL takes precedence over any router ACLs or VLAN maps that af fect
the same interface.
The IP source binding table has bindings that are learned by DHCP snooping or are manually configured
(static IP source bindings). An entry in this table has an IP address, its associated MAC address, and its
associated VLAN number. The switch uses the IP source binding table only w hen I P so urc e gu ar d is
enabled.
IP source guard is supported only on Layer 2 ports, including access and trunk por ts.You can configure
IP source guard with source IP address filtering or with source IP and M AC address filtering .
These sections contain this information:
•Source IP Address Filtering, page 21-16
•Source IP and MAC Address Filtering, page21-17

Source IP Address Filtering

When IP source guard is enabled with this option, IP traffic is filtered based on the source IP address.
The switch forwards IP traffic when the source IP address matches an en try in t he D HCP snoo ping
binding database or a binding in the IP source binding table.
When a DHCP snooping binding or static IP source binding is added, chan ged, or deleted on an interface,
the switch modifies the port ACL using the IP source binding changes, and re -appl ie s the por t ACL to
the interface.
If you enable IP source guard on an interface on which IP source b indi ngs ( dyna m ical ly l ear ned by
DHCP snooping or manually configured) are not configured, the switch creates and app lie s a port ACL
that denies all IP traffic on the interface. If you disable IP source guard, the switch removes the port A CL
from the interface.