Login
- Table of Contents
-
- 03-Security Command Reference
- 00-Preface
- 01-Security zone commands
- 02-Security policy commands
- 03-ASPF commands
- 04-Session management commands
- 05-Object group commands
- 06-Object policy commands
- 07-IP source guard commands
- 08-AAA commands
- 09-User identification commands
- 10-Password control commands
- 11-Portal commands
- 12-MAC authentication commands
- 13-IPoE commands
- 14-Public key management commands
- 15-PKI commands
- 16-SSH commands
- 17-SSL commands
- 18-Connection limit commands
- 19-Attack detection and prevention commands
- 20-Server connection detection commands
- 21-ARP attack protection commands
- 22-ND attack defense commands
- 23-uRPF commands
- 24-IP-MAC binding commands
- 25-IP reputation commands
- 26-APR commands
- 27-Keychain commands
- 28-Crypto engine commands
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 07-IP source guard commands | 84.45 KB |
Contents
ip source binding (interface view)
ip source binding (system view)
ipv6 source binding (interface view)
ipv6 source binding (system view)
IP source guard commands
display ip source binding
Use display ip source binding to display IPv4SG bindings.
Syntax
display ip source binding [ static | [ vpn-instance vpn-instance-name ] [ dhcp-relay | dhcp-server ip-mac-vlan | ip-mac-vpn ] ] [ ip-address ip-address ] [ mac-address mac-address ] [ vlan vlan-id ] [ interface interface-type interface-number ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
context-admin
context-operator
Parameters
static: Displays static IPv4SG bindings.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters. To display dynamic IPv4SG bindings for the public network, do not specify a VPN instance.
dhcp-relay: Specifies the DHCP relay agent module.
dhcp-server: Specifies the DHCP server module.
ip-mac-vlan: Specifies IPv4SG IP-MAC-VLAN bindings that are generated based on the IP-MAC binding module.
ip-mac-vpn: Specifies IPv4SG IP-MAC-VPN bindings that are generated based on the IP-MAC binding module.
ip-address ip-address: Specifies an IPv4 address.
mac-address mac-address: Specifies a MAC address in H-H-H format.
vlan vlan-id: Specifies a VLAN ID in the range of 1 to 4094.
interface interface-type interface-number: Specifies an interface by its type and number.
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays IPv4SG bindings for the global active MPU.
Examples
# Display all IPSG bindings on the public network.
<Sysname> display ip source binding
Total entries found: 5
IP Address MAC Address Interface VLAN Type
10.1.0.5 040a-0000-4000 GE1/2/5/1 N/A DHCP server
10.1.0.6 040a-0000-3000 GE1/2/5/1 N/A DHCP server
10.1.0.7 040a-0000-2000 GE1/2/5/1 N/A DHCP server
10.1.0.8 040a-0000-1000 GE1/2/5/2 N/A DHCP relay
10.1.0.9 040a-0000-2000 GE1/2/5/2 N/A Static
Table 1 Command output
|
Field |
Description |
|
Total entries found |
Total number of IPv4SG bindings. |
|
IP Address |
IPv4 address in the IPv4SG binding. If no IP address is bound in the binding, this field displays N/A. |
|
MAC Address |
MAC address in the IPv4SG binding. If no MAC address is bound in the binding, this field displays N/A. |
|
Interface |
Interface of the binding. This field displays N/A for a global IPv4SG binding. |
|
VLAN |
VLAN information in the IPv4SG binding. If the binding contains no VLAN information, this field displays N/A. |
|
Type |
IPSG binding type: · Static—Manually configured by using the ip source binding command. Static bindings are for packet filtering in IPSG or used by other modules to provide security services. · DHCP relay—Dynamically generated based on DHCP relay agent. The binding is for packet filtering in IPSG. · DHCP server—Dynamically generated based on DHCP server. The binding is used by other modules to provide security services. · IP-MAC VLAN—Dynamically generated based on IP-MAC binding module. This type of IPSG bindings binds IPv4 address, MAC address, and VLAN ID. · IP-MAC VPN—Dynamically generated based on IP-MAC binding module. This type of IPSG bindings binds IPv4 address, MAC address, and VPN instance. |
Related commands
ip source binding
ip verify source
display ipv6 source binding
Use display ipv6 source binding to display IPv6SG bindings.
Syntax
display ipv6 source binding [ static | [ vpn-instance vpn-instance-name ] [ ipv6-mac-vlan | ipv6-mac-vpn ] ] [ ip-address ipv6-address ] [ mac-address mac-address ] [ vlan vlan-id ] [ interface interface-type interface-number ] [ chassis chassis-number slot slot-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
context-admin
context-operator
Parameters
static: Displays static IPv6SG bindings.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters. To display dynamic IPv6SG bindings for the public network, do not specify a VPN instance.
ipv6-mac-vlan: Specifies IPv6SG IPv6-MAC-VLAN bindings that are generated based on the IP-MAC binding module.
ipv6-mac-vpn: Specifies IPv6SG IPv6-MAC-VPN bindings that are generated based on the IP-MAC binding module.
ip-address ipv6-address: Specifies an IPv6 address.
mac-address mac-address: Specifies a MAC address in H-H-H format.
vlan vlan-id: Specifies a VLAN ID in the range of 1 to 4094.
interface interface-type interface-number: Specifies an interface by its type and number.
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays IPv6SG bindings for the global active MPU.
Examples
# Display all IPv6SG bindings on the public network.
<Sysname> display ipv6 source binding
Total entries found: 2
IPv6 Address MAC Address Interface VLAN Type
2012:1222:2012:1222: 000f-2202-0436 GE1/2/5/1 N/A Static
2012:1222:2012:1223
2012:1222:2012:1222: 040a-0000-4000 N/A N/A Static
2012:1222:2012:1225
Table 2 Command output
|
Field |
Description |
|
Total entries found |
Total number of IPv6SG bindings. |
|
IPv6 Address |
IPv6 address in the IPv6SG binding. If no IPv6 address is bound in the binding, this field displays N/A. |
|
MAC Address |
MAC address in the IPv6SG binding. If no MAC address is bound in the binding, this field displays N/A. |
|
Interface |
Interface of the IPv6SG binding. This field displays N/A for a global IPv6SG binding. |
|
VLAN |
VLAN information in the IPv6SG binding. If the binding contains no VLAN information, this field displays N/A. |
|
Type |
Type of the IPv6SG binding: · Static—Manually configured by using the ipv6 source binding command. Static bindings are for packet filtering in IPv6SG or used by other modules to provide security services. · IPv6-MAC VLAN—Dynamically generated based on IP-MAC binding module. This type of IPSG bindings binds IPv6 address, MAC address, and VLAN ID. · IPv6-MAC VPN—Dynamically generated based on IP-MAC binding module. This type of IPSG bindings binds IPv6 address, MAC address, and VPN instance. |
Related commands
ipv6 source binding
ipv6 verify source
ip source binding (interface view)
Use ip source binding to configure a static IPv4SG binding on an interface.
Use undo ip source binding to delete the static IPv4SG bindings configured on an interface.
Syntax
ip source binding { ip-address ip-address | ip-address ip-address mac-address mac-address | mac-address mac-address }
undo ip source binding { all | ip-address ip-address | ip-address ip-address mac-address mac-address | mac-address mac-address }
Default
No static IPv4SG bindings are configured on an interface.
Views
Layer 2 Ethernet interface view
Layer 3 Ethernet interface view
Layer 3 Ethernet subinterface view
VLAN interface view
Reth interface view
Reth subinterface view
Predefined user roles
network-admin
context-admin
Parameters
all: Removes all static IPv4SG bindings on the interface.
ip-address ip-address: Specifies an IPv4 address for the static binding. The IPv4 address must be a class A, B, or C address, and cannot be 127.x.x.x or 0.0.0.0.
mac-address mac-address: Specifies a MAC address for the static binding. The MAC address must be in H-H-H format, and cannot be all 0s, all Fs (a broadcast MAC address), or a multicast MAC address.
Usage guidelines
Static IPv4SG bindings on an interface implement the following functions:
· Filter incoming IPv4 packets on the interface.
· Check user validity by cooperating with the ARP attack detection feature.
You cannot configure static IPv4SG bindings on a service loopback interface.
Examples
# Configure a static IPv4SG binding on GigabitEthernet 1/2/5/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/2/5/1
[Sysname-GigabitEthernet1/2/5/1] ip source binding ip-address 192.168.0.1 mac-address 0001-0001-0001
Related commands
display ip source binding
ip source binding (system view)
ip source binding (system view)
Use ip source binding to configure a global static IPv4SG binding.
Use undo ip source binding to delete one or all global static IPv4SG bindings.
Syntax
ip source binding ip-address ip-address mac-address mac-address
undo ip source binding { all | ip-address ip-address mac-address mac-address }
Default
No global static IPv4SG bindings exist.
Views
System view
Predefined user roles
network-admin
context-admin
Parameters
ip-address ip-address: Specifies the IPv4 address for the static binding. The IPv4 address must be a class A, B, or C address, and cannot be 127.x.x.x or 0.0.0.0.
mac-address mac-address: Specifies the MAC address for the static binding. The MAC address is in the format H-H-H but cannot be all 0s, all Fs (a broadcast MAC address), or a multicast MAC address.
all: Removes all global static IPv4SG bindings.
Usage guidelines
A global static IPv4SG binding takes effect on all interfaces.
Examples
# Configure a global static IPv4SG binding.
<Sysname> system-view
[Sysname] ip source binding ip-address 192.168.0.1 mac-address 0001-0001-0001
Related commands
display ip source binding
ip source binding (interface view)
ip verify source
Use ip verify source to enable IPv4SG on an interface.
Use undo ip verify source to disable IPv4SG on an interface.
Syntax
ip verify source { ip-address | ip-address mac-address | mac-address }
undo ip verify source
Default
The IPv4SG feature is disabled on an interface.
Views
Layer 2 Ethernet interface view
Layer 3 Ethernet interface view
Layer 3 Ethernet subinterface view
Layer 3 aggregate interface view
Layer 3 aggregate subinterface view
VLAN interface view
Reth interface view
Reth subinterface view
Predefined user roles
network-admin
context-admin
Parameters
ip-address: Filters incoming packets by source IPv4 addresses.
ip-address mac-address: Filters incoming packets by source IPv4 addresses and source MAC addresses.
mac-address: Filters incoming packets by source MAC addresses.
Usage guidelines
After you enable IPv4SG on an interface, this feature uses static and dynamic IPv4SG bindings to match incoming packets on the interface. Packets that match an IPv4SG binding are forwarded and packets that do not match any IPv4SG binding are discarded.
The matching criterion specified by this command applies only to dynamic IPSG. Static IPv4SG uses static bindings configured by using the ip source binding command.
You cannot enable dynamic IPv4SG on a service loopback interface.
Examples
# Enable IPv4SG on Layer 2 Ethernet interface GigabitEthernet 1/2/5/1 and verify the source IPv4 address and MAC address for dynamic IPSG.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/2/5/1
[Sysname-GigabitEthernet1/2/5/1] ip verify source ip-address mac-address
# Enable IPv4SG on VLAN-interface 100 and verify the source IPv4 address and MAC address for dynamic IPSG.
<Sysname> system-view
[Sysname] interface vlan-interface 100
[Sysname-Vlan-interface100] ip verify source ip-address mac-address
# Enable IPv4SG on Layer 3 Ethernet interface GigabitEthernet 1/2/5/2 and verify the source IPv4 address and MAC address for dynamic IPSG.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/2/5/2
[Sysname-GigabitEthernet1/2/5/2] ip verify source ip-address mac-address
# Enable IPv4SG on Layer 3 Ethernet interface GigabitEthernet 1/2/5/2 and verify the source MAC address for dynamic IPSG.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/2/5/2
[Sysname-GigabitEthernet1/2/5/2] ip verify source mac-address
Related commands
display ip source binding
ipv6 source binding (interface view)
Use ipv6 source binding to configure a static IPv6SG binding.
Use undo ipv6 source binding to delete the static IPv6SG bindings configured on an interface.
Syntax
ipv6 source binding { ip-address ipv6-address | ip-address ipv6-address mac-address mac-address | mac-address mac-address }
undo ipv6 source binding { all | ip-address ipv6-address | ip-address ipv6-address mac-address mac-address | mac-address mac-address }
Default
No static IPv6SG bindings exist on an interface.
Views
Layer 2 Ethernet interface view
Layer 3 Ethernet interface view
Layer 3 Ethernet subinterface view
VLAN interface view
Reth interface view
Reth subinterface view
Predefined user roles
network-admin
context-admin
Parameters
all: Removes all the static IPv6SG bindings on the interface.
ip-address ipv6-address: Specifies an IPv6 address for the static binding. The IPv6 address cannot be an all-zero address, a multicast address, or a loopback address.
mac-address mac-address: Specifies a MAC address for the static binding. The MAC address must be in H-H-H format, and cannot be all 0s, all Fs (a broadcast MAC address), or a multicast MAC address.
Usage guidelines
Static IPv6SG bindings on an interface filter incoming IPv6 packets.
You cannot configure static IPv6SG bindings on a service loopback interface.
Examples
# Configure a static IPv6SG binding on GigabitEthernet 1/2/5/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/2/5/1
[Sysname-GigabitEthernet1/2/5/1] ipv6 source binding ip-address 2001::1 mac-address 0002-0002-0002
Related commands
display ipv6 source binding
ipv6 source binding (system view)
ipv6 source binding (system view)
Use ipv6 source binding to configure a global static IPv6SG binding.
Use undo ipv6 source binding to delete one or all global static IPv6SG bindings.
Syntax
ipv6 source binding ip-address ipv6-address mac-address mac-address
undo ipv6 source binding { all | ip-address ipv6-address mac-address mac-address }
Default
No global static IPv6SG bindings exist.
Views
System view
Predefined user roles
network-admin
context-admin
Parameters
ipv6-address ipv6-address: Specifies the IPv6 address for the static binding. The IPv6 address cannot be an all-zero address, a multicast address, or a loopback address.
mac-address mac-address: Specifies the MAC address for the static binding. The MAC address must be in H-H-H format, and cannot be all 0s, all Fs (a broadcast MAC address), or a multicast MAC address.
all: Removes all global static IPv6SG bindings.
Usage guidelines
A global static IPv6SG binding takes effect on all interfaces.
Examples
# Configure a global static IPv6SG binding.
<Sysname> system-view
[Sysname] ipv6 source binding ipv6-address 2001::1 mac-address 0002-0002-0002
Related commands
display ipv6 source binding
ipv6 source binding (interface view)
ipv6 verify source
Use ipv6 verify source to enable IPv6SG on an interface.
Use undo ipv6 verify source to disable IPv6SG on an interface.
Syntax
ipv6 verify source { ip-address | ip-address mac-address | mac-address }
undo ipv6 verify source
Default
The IPv6SG feature is disabled on an interface.
Views
Layer 2 Ethernet interface view
Layer 3 Ethernet interface view
Layer 3 Ethernet subinterface view
Layer 3 aggregate interface view
Layer 3 aggregate subinterface view
VLAN interface view
Reth interface view
Reth subinterface view
Predefined user roles
network-admin
context-admin
Parameters
ip-address: Filters incoming packets by source IPv6 addresses.
ip-address mac-addr ess: Filters incoming packets by source IPv6 addresses and source MAC addresses.
mac-address: Filters incoming packets by source MAC addresses.
Usage guidelines
After you enable IPv6SG on an interface, this feature uses static and dynamic IPv6SG bindings to match incoming packets on the interface. Packets that match an IPv6SG binding are forwarded and packets that do not match any IPv6SG binding are discarded.
The matching criterion specified by this command applies only to dynamic IPv6SG. Static IPv6SG uses static bindings configured by using the ipv6 source binding command.
You cannot enable dynamic IPv6SG on a service loopback interface.
Examples
# Enable IPv6SG on Layer 2 Ethernet interface GigabitEthernet 1/2/5/1 and verify the source IPv6 address and MAC address for dynamic IPv6SG.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/2/5/1
[Sysname-GigabitEthernet1/2/5/1] ipv6 verify source ip-address mac-address
Related commands
display ipv6 source binding
