Table of Contents

Chapter 1 IP Source Guard Configuration. 1-1

1.1 IP Source Guard Overview. 1-1

1.2 Configuring a Static Binding Entry. 1-1

1.3 Configuring Dynamic Binding Function. 1-2

1.4 Displaying IP Source Guard. 1-3

1.5 IP Source Guard Configuration Examples. 1-3

1.5.1 Static Binding Entry Configuration Example. 1-3

1.5.2 Dynamic Binding Function Configuration Example. 1-5

1.6 Troubleshooting. 1-7

1.6.1 Failed to Configure Static Binding Entries and Dynamic Binding Function. 1-7

 

Chapter 1  IP Source Guard Configuration

When configuring IP Source Guard, go to these sections for information you are interested in:

l           IP Source Guard Overview

l           Configuring a Static Binding Entry

l           Configuring Dynamic Binding Function

l           Displaying IP Source Guard

l           IP Source Guard Configuration Examples

l           Troubleshooting

1.1  IP Source Guard Overview

By filtering packets on a per-port basis, IP source guard prevents packets with illegal IP addresses and MAC addresses from traveling through, improving the network security. After receiving a packet, the port looks up the key attributes (including IP address, MAC address and VLAN tag) of the packet in the binding entries of the IP source guard. If there is a matching entry, the port will forward the packet. Otherwise, the port will abandon the packet.

IP source guard filters packets based on the following types of binding entries:

l           IP-port binding entry

l           MAC-port binding entry

l           IP-MAC-port binding entry

You can manually set static binding entries, or use DHCP Snooping to provide dynamic binding entries. Binding is on a per-port basis. After a binding entry is configured on a port, it is effective only to the port, instead of other ports.

 

 

1.2  Configuring a Static Binding Entry

Follow these steps to configure a static binding entry:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Enter interface view	interface interface-type interface-number	—
Configure a static binding entry	user-bind { ip-address ip-address | ip-address ip-address mac-address mac-address | mac-address mac-address }	Required No static binding entry exists by default.

 

 

1.3  Configuring Dynamic Binding Function

After the dynamic binding function is enabled on a port, IP source guard will receive and process corresponding DHCP Snooping entries, which contain such information as MAC address, IP address, VLAN tag, port information or entry type. It adds the obtained information to the dynamic binding entries to enable the port to filter packets according to the binding entries.

Follow these steps to configure dynamic binding function:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Enter interface view	interface interface-type interface-number	—
Configure dynamic binding function	ip check source { ip-address | ip-address mac-address | mac-address }	Required Not configured by default

 

1.4  Displaying IP Source Guard

To do…	Use the command…	Remarks
Display information about static binding entries	display user-bind [ interface interface-type interface-number | ip-address ip-address | mac-address mac-address ]	Available in any view
Display information about dynamic binding entries	display ip check source [ interface interface-type interface-number | ip-address ip-address | mac-address mac-address ]	Available in any view

 

1.5  IP Source Guard Configuration Examples

1.5.1  Static Binding Entry Configuration Example

I. Network requirements

As shown in Figure 1-1, switches A and B and Hosts A, B and C are on an Ethernet. Host A and Host B are connected to ports GigabitEthernet1/0/1 and GigabitEthernet1/0/2 of Switch B respectively, Host C is connected to port GigabitEthernet1/0/2 of Switch A, while Switch B is connected to port GigabitEthernet1/0/1 of Switch A.

Detailed requirements are as follows:

l           On port GigabitEthernet1/0/2 of Switch A, only IP packets with the source MAC address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 can pass.

l           On port GigabitEthernet1/0/1 of Switch A, only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.

l           On port GigabitEthernet1/0/1 of Switch B, only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.

l           On port GigabitEthernet1/0/2 of Switch B, only IP packets with the source MAC address of 00-01-02-03-04-07 and the source IP address of 192.168.0.2 can pass.

II. Network diagram

Figure 1-1 Network diagram for configuring static binding entries

III. Configuration procedure

1)         Configure Switch A

# Configure the IP addresses of various interfaces (omitted).

# Configure port GigabitEthernet1/0/2 of Switch A to allow only IP packets with the source MAC address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 to pass.

<SwitchA> system-view

[SwitchA] interface GigabitEthernet 1/0/2

[SwitchA-GigabitEthernet1/0/2] user-bind ip-address 192.168.0.3 mac-address 0001-0203-0405

[SwitchA-GigabitEthernet1/0/2] quit

# Configure port GigabitEthernet1/0/1 of Switch A to allow only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.

[SwitchA] interface GigabitEthernet1/0/1

[SwitchA-GigabitEthernet1/0/1] user-bind ip-address 192.168.0.1 mac-address 0001-0203-0406

2)         Configure Switch B

# Configure the IP addresses of various interfaces (omitted).

# Configure port GigabitEthernet1/0/1 of Switch B to allow only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.

<SwitchB> system-view

[SwitchB] interface GigabitEthernet1/0/1

[SwitchB-GigabitEthernet1/0/1] user-bind ip-address 192.168.0.1 mac-address 0001-0203-0406

[SwitchB-GigabitEthernet1/0/1] quit

# Configure port GigabitEthernet1/0/2 of Switch B to allow only IP packets with the source MAC address of 00-01-02-03-04-07 and the source IP address of 192.168.0.2 to pass.

[SwitchB] interface GigabitEthernet1/0/2

[SwitchB-GigabitEthernet1/0/2] user-bind ip-address 192.168.0.2 mac-address 0001-0203-0407

3)         Verify the configuration

# On Switch A, static binding entries are configured successfully.

<SwitchA> display user-bind

The following user address bindings have been configured:

 MAC               IP               Vlan   Port                         Status

 0001-0203-0405      192.168.0.3           N/A    GigabitEthernet1/0/2                 Static

 0001-0203-0406      192.168.0.1           N/A    GigabitEthernet1/0/1                 Static

------------------2 binding entries queried, 2 listed------------------

# On Switch B, static binding entries are configured successfully.

<SwitchB> display user-bind

The following user address bindings have been configured:

MAC               IP               Vlan   Port                         Status

 0001-0203-0406     192.168.0.1          N/A      GigabitEthernet1/0/1                 Static

 0001-0203-0407     192.168.0.2          N/A      GigabitEthernet1/0/2                 Static

------------------2 binding entries queried, 2 listed------------------

1.5.2  Dynamic Binding Function Configuration Example

I. Network requirements

Switch A connects to Client A and the DHCP Server through GigabitEthernet1/0/1 and GigabitEthernet1/0/2 respectively. DHCP Snooping is enabled on Switch A.

Detailed requirements are as follows:

l           Client A with the MAC address of 00-01-02-03-04-06 obtains an IP address through the DHCP Server.

l           On Switch A, create the DHCP Snooping entry of Client A.

l           On port GigabitEthernet1/0/1 of Switch A, enable dynamic binding function to prevent attacks from using forged IP addresses to attack the server.

 

 

II. Network diagram

Figure 1-2 Network diagram for configuring dynamic binding

III. Configuration procedure

1)         Configure Switch A

# Configure dynamic binding on port GigabitEthernet1/0/1.

<SwitchA> system-view

[SwitchA] interface GigabitEthernet 1/0/1

[SwitchA-GigabitEthernet1/0/1] ip check source ip-address mac-address

[SwitchA-GigabitEthernet1/0/1] quit

# Enable DHCP snooping on Switch A.

[SwitchA] dhcp-snooping

# Configure port GigabitEthernet1/0/2 connected to the DHCP server as a trusted port.

[SwitchA] interface GigabitEthernet1/0/2

[SwitchA-GigabitEthernet1/0/2] dhcp-snooping trust

[SwitchA-GigabitEthernet1/0/2] quit

2)         Verify the configuration

# Display the dynamic binding entries that port GigabitEthernet1/0/1 has obtained from DHCP Snooping.

<SwitchA> display ip check source

The following user address bindings have been configured:

 MAC               IP               Vlan   Port                         Status

 0001-0203-0406     192.168.0.1         1      GigabitEthernet1/0/1              DHCP-SNP

 -----------------1 binding entries queried, 1 listed------------------

# Display the dynamic entries of DHCP Snooping and check it is identical with the dynamic entries that port GigabitEthernet1/0/1 has obtained.

<SwitchA> display dhcp-snooping

DHCP Snooping is enabled.

The client binding table for all untrusted ports.

Type : D--Dynamic , S--Static

Type IP Address      MAC Address    Lease        VLAN Interface

==== =============== ============== ============ ==== =================

D    192.168.0.1     0001-0203-0406 86335        1    GigabitEthernet1/0/1

As you see, port GigabitEthernet1/0/1 has obtained the dynamic entries generated by DHCP Snooping after it is configured with dynamic binding function.

1.6  Troubleshooting

1.6.1  Failed to Configure Static Binding Entries and Dynamic Binding Function

I. Symptom

Configuring static binding entries and dynamic binding function fails on a port.

II. Analysis

IP Source Guard is not supported on the port which has joined an aggregation group. Neither static binding entries nor dynamic binding function can be configured on the port which has joined an aggregation group.

III. Solution

Remove the port from the aggregation group.