C
ONFIGURING

IP S

OURCE

G

UARD

7-5

Configuring IP Source Guard
IP Source Guard is a security feature that filters IP traffic on unsecure
network interfaces based on static entries configured in the IP Source
Guard table, or dynamic entries in the DHCP Snooping table.
Command Usage
• Source guard is used to filter traffic on an unsecure port which receives
messages from outside the network or firewall, an d therefore may be
subject to traffic attacks caused by a host trying to use the IP address of
a neighbor.
• Setting source guard mode to “Source IP” or “Source IP and MAC”
enables this function on the selected port. Use the “Source IP” option to
check the VLAN ID, source IP address, and port number against all
entries in the binding table. Use the “Source IP and MAC” option to
check these same parameters, plus the source MAC address.
• When enabled, traffic is filtered based upon dynamic entries learned via
DHCP snooping (see “Configuring DHCP Snooping” on page7-8), or
static addresses configured in the source guard binding table.
• Static addresses entered in the source guard binding table are
automatically configured with an infinite lease time. Dynamic entries
learned via DHCP snooping are configured by the DHCP server itself,
static entries include a manually configured lease time.
• Static bindings are processed as follows:
- If there is no entry with same VLAN ID and MAC address, a new
entry is added to binding table using the type “static IP source guard
binding.”
- If there is an entry with same VLAN ID and MAC address, and the
type of entry is static IP source guard binding, then the new entry will
replace the old one.
- If there is an entry with same VLAN ID and MAC address, and the
type of the entry is dynamic DHCP snooping binding, then the new
entry will replace the old one and the entry type will be changed to
static IP source guard binding.