By filtering packets on a per-port basis, IP source guard prevents packets with illegal IP addresses and MAC addresses from traveling through, improving the network security. After receiving a packet, the port looks up the key attributes of the packet in the binding entries of the IP source guard. If there is a matching entry, the port will forward the packet. Otherwise, the port will abandon the packet.

IP source guard filters packets based on the following types of binding entries:

l IP-port binding entry,

l MAC-port binding entry

l IP-MAC-port binding entry

You can manually set static binding entries, or use DHCP Snooping to provide dynamic binding entries. Binding is on a per-port basis. After a binding entry is configured on a port, it is effective only to the port, instead of other ports.

Caution:

IP source guard and aggregation group configuration are mutually exclusive.

1.2 Configuring a Static Binding Entry

Follow these steps to configure a static binding entry:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Enter interface view	interface interface-type interface-number	—
Configure a static binding entry	user-bind { ip-address ip-address \| ip-address ip-address mac-address mac-address \| mac-address mac-address }	Required No static binding entry exists by default.

& Note:

l The system does not support repeatedly configuring a binding entry to one port. A binding entry can be configured to multiple ports.

l In a valid binding entry, the MAC address cannot be all 0s, all Fs (a broadcast address), or a multicast address, and the IP address can only be a Class A, Class B, or Class C address and can be neither 127.x.x.x nor 0.0.0.0.

1.3 Configuring Dynamic Binding Function

After the dynamic binding function is enabled on a port, IP source guard will receive and process corresponding DHCP Snooping entries, which contain such information as MAC address, IP address, VLAN tag, port information or entry type. It adds the obtained information to the dynamic binding entries to enable the port to filter packets according to the binding entries.

Follow these steps to configure dynamic binding function:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Enter interface view	interface interface-type interface-number	—
Configure dynamic binding function	ip check source { ip-address \| ip-address mac-address \| mac-address }	Required Not configured by default

1.4 Displaying IP Source Guard

To do…	Use the command…	Remarks
Display information about static binding entries	display user-bind [ interface interface-type interface-number \| ip-address ip-address \| mac-address mac-address ]	Available in any view
Display information about dynamic binding entries	display ip check source [ interface interface-type interface-number \| ip-address ip-address \| mac-address mac-address ]	Available in any view

1.5 IP Source Guard Configuration Examples

1.5.1 Static Binding Entry Configuration Example

I. Network requirements

As shown in Figure 1-1, switches A and B and Hosts A, B and C are on an Ethernet. Host A and Host B are connected to ports Ethernet 2/0/1 and Ethernet 2/0/2 of Switch B respectively, Host C is connected to port Ethernet 2/0/2 of Switch A, while Switch B is connected to port Ethernet 2/0/1 of Switch A.

Detailed requirements are as follows:

l On port Ethernet 2/0/2 of Switch A, only IP packets with the source MAC address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 can pass.

l On port Ethernet 2/0/1 of Switch A, only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.

l On port Ethernet 2/0/1 of Switch B, only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.

l On port Ethernet 2/0/2 of Switch B, only IP packets with the source MAC address of 00-01-02-03-04-07 and the source IP address of 192.168.0.2 can pass.

II. Network diagram

Figure 1-1 Network diagram for configuring static binding entries

III. Configuration procedure

1) Configure Switch A

# Configure the IP addresses of various interfaces (omitted).

# Configure port Ethernet 2/0/2 of Switch A to allow only IP packets with the source MAC address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 to pass.

<SwitchA> system-view

[SwitchA] interface ethernet 2/0/2

[SwitchA-Ethernet2/0/2] user-bind ip-address 192.168.0.3 mac-address 0001-0203-0405

[SwitchA-Ethernet2/0/2] quit

# Configure port Ethernet 2/0/1 of Switch A to allow only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.

[SwitchA] interface ethernet 2/0/1

[SwitchA-Ethernet2/0/1] user-bind ip-address 192.168.0.1 mac-address 0001-0203-0406

2) Configure Switch B

# Configure the IP addresses of various interfaces (omitted).

# Configure port Ethernet 2/0/1 of Switch B to allow only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.

<SwitchB> system-view

[SwitchB] interface ethernet 2/0/1

[SwitchB-Ethernet2/0/1] user-bind ip-address 192.168.0.1 mac-address 0001-0203-0406

[SwitchA-Ethernet2/0/1] quit

# Configure port Ethernet 2/0/2 of Switch B to allow only IP packets with the source MAC address of 00-01-02-03-04-07 and the source IP address of 192.168.0.2 to pass.

[SwitchB] interface ethernet 2/0/2

[SwitchB-Ethernet2/0/2] user-bind ip-address 192.168.0.2 mac-address 0001-0203-0407

3) Verify the configuration

# On Switch A, static binding entries are configured successfully.

<SwitchA> display user-bind

The following user address bindings have been configured:

MAC IP Vlan Port Status

0001-0203-0405 192.168.0.3 N/A Ethernet2/0/2 Static

0001-0203-0406 192.168.0.1 N/A Ethernet2/0/1 Static

------------------2 binding entries queried, 2 listed------------------

# On Switch B, static binding entries are configured successfully.

<SwitchB> display user-bind

The following user address bindings have been configured:

MAC IP Vlan Port Status

0001-0203-0406 192.168.0.1 N/A Ethernet2/0/1 Static

0001-0203-0407 192.168.0.2 N/A Ethernet2/0/2 Static

------------------2 binding entries queried, 2 listed------------------

1.5.2 Dynamic binding Configuration Example

I. Network requirements

Switch A connects to Client A and the DHCP Server through Ethernet 2/0/1 and Ethernet 2/0/2 respectively. DHCP Snooping is enabled on Switch A.

Detailed requirements are as follows:

l Client A with the MAC address of 00-01-02-03-04-06 obtains an IP address through the DHCP Server.

l On Switch A, create the DHCP Snooping entry of Client A.

l Enable IP filtering on port Ethernet 2/0/1 of Switch A to prevent attacks from clients using fake source IP addresses to the DHCP server.

& Note:

For detailed configuration of DHCP Server, refer to DHCP Configuration in this manual.

II. Network diagram

Figure 1-2 Network diagram for configuring dynamic binding

III. Configuration procedure

1) Configure Switch A

# Configure dynamic binding on port Ethernet 2/0/1.

<SwitchA> system-view

[SwitchA] interface ethernet2/0/1

[SwitchA-Ethernet2/0/1] ip check source ip-address mac-address

[SwitchA-Ethernet2/0/1] quit

# Enable DHCP snooping on Switch A.

[SwitchA] dhcp-snooping

# Configure port Ethernet 2/0/2 connected to the DHCP server as a trusted port.

[SwitchA] interface ethernet2/0/2

[SwitchA-Ethernet2/0/2] dhcp-snooping trust

[SwitchA-Ethernet2/0/2] quit

2) Verify the configuration

# Dynamic binding is configured successfully on port Ethernet 2/0/1.

[SwitchA] interface ethernet2/0/1

[SwitchA-Ethernet2/0/1] display this

interface Ethernet2/0/1

ip check source ip-address mac-address

return

# Display the dynamic binding entries that port Ethernet 2/0/1 has obtained from DHCP Snooping.

<SwitchA> display ip check source

The following user address bindings have been configured:

MAC IP Vlan Port Status

0001-0203-0406 192.168.0.1 1 Ethernet2/0/1 DHCP-SNP

-----------------1 binding entries queried, 1 listed------------------

# Display the dynamic entries of DHCP Snooping and check it is identical with the dynamic entries that port Ethernet 2/0/1 has obtained.

<SwitchA> display dhcp-snooping

DHCP Snooping is enabled.

The client binding table for all untrusted ports.

Type : D--Dynamic , S--Static

Type IP Address MAC Address Lease VLAN Interface

==== =============== ============== ============ ==== =================

D 192.168.0.1 0001-0203-0406 86335 1 Ethernet2/0/1

As you see, port Ethernet 2/0/1 has obtained the dynamic entries generated by DHCP Snooping after it is configured with dynamic binding.

1.6 Troubleshooting

1.6.1 Failed to Configure Static Binding Entries and Dynamic binding Function

I. Symptom

Configuring static binding entries and dynamic binding fails on a port.

II. Analysis

IP Source Guard is not supported on the port which has joined an aggregation group. Neither static binding entries nor dynamic binding function can be configured on the port which has joined an aggregation group.

III. Solution

Remove the port from the aggregation group.

H3C S7500E Series Ethernet Switches Operation Manual(Release 6100 series V1.01)

Chapter 1 IP Source Guard Configuration

1.1 IP Source Guard Overview

1.2 Configuring a Static Binding Entry

1.4 Displaying IP Source Guard

I. Network requirements

II. Network diagram

I. Network requirements

II. Network diagram

III. Configuration procedure

1.6 Troubleshooting

1.6.1 Failed to Configure Static Binding Entries and Dynamic binding Function

I. Symptom

II. Analysis

III. Solution

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Policy & Program

Global Learning

Partner Sales Resources

Service Business

News & Events

Contact Us