Contents

Introduction· 1

Prerequisites· 1

Example: Configuring dynamic IPv4SG based on DHCP relay agent 1

Network configuration· 1

Analysis· 1

Procedures· 2

Configuring the DHCP server 2

Configuring the device· 2

Configuring DHCP clients· 3

Verifying the configuration· 3

Configuration files· 3

Related documentation· 3

Introduction

This document provides IP source guard (IPSG) configuration examples.

IPSG prevents spoofing attacks by using IPSG bindings to filter incoming packets. IPSG bindings include static bindings that are configured manually and dynamic bindings that are generated based on information from DHCP-related modules. IPSG forwards only the packets that match IPSG bindings.

Prerequisites

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of IPSG.

Example: Configuring dynamic IPv4SG based on DHCP relay agent

Network configuration

As shown in Figure 1, DHCP relay is enabled on the device. The DHCP clients obtain IP addresses from the DHCP server through the DHCP relay agent.

Enable dynamic IPv4SG on Ten-GigabitEthernet 0/0/15 to filter incoming packets by using the dynamic IPv4SG bindings generated based on the DHCP relay entries.

Figure 1 Network diagram

‌

Analysis

To generate DHCP relay entries for the DHCP clients, enable recording of relay entries on the delay agent. By default, the DHCP relay agent does not record client information in relay entries.

Procedures

Configuring the DHCP server

This example uses an H3C CR16000-M1A router as the DHCP server.

# Assign an IP address to Ten-GigabitEthernet 0/0/15.

<DHCPserver> system-view

[DHCPserver] interface ten-gigabitethernet 0/0/15

[DHCPserver-Ten-GigabitEthernet0/0/15] ip address 10.10.0.2 255.255.255.0

# Enable the DHCP server on Ten-GigabitEthernet 0/0/15.

[DHCPserver-Ten-GigabitEthernet0/0/15] dhcp select server

[DHCPserver-Ten-GigabitEthernet0/0/15] quit

# Enable DHCP.

[DHCPserver] dhcp enable

# Create DHCP address pool 1.

[DHCPserver] dhcp server ip-pool 1

# Specify the assignable subnet as 192.168.0.0/24 and the address lease duration as 7 days.

[DHCPserver-dhcp-pool-1] network 192.168.0.0 24

[DHCPserver-dhcp-pool-1] expired day 7

[DHCPserver-dhcp-pool-1] quit

# Configure a static route for the subnet where Ten-GigabitEthernet 0/0/15 of the DHCP relay agent resides on the DHCP server.

[DHCPserver] ip route-static 192.168.0.0 24 10.10.0.1

Configuring the device

# Assign an IP address to Ten-GigabitEthernet 0/0/15.

<Device> system-view

[Device] interface ten-gigabitethernet 0/0/15

[Device-Ten-GigabitEthernet0/0/15] ip address 192.168.0.1 255.255.255.0

[Device-Ten-GigabitEthernet0/0/15] quit

# Assign an IP address to Ten-GigabitEthernet 0/0/16.

[Device] interface ten-gigabitethernet 0/0/16

[Device-Ten-GigabitEthernet0/0/16] ip address 10.10.0.1 255.255.255.0

[Device-Ten-GigabitEthernet0/0/16] quit

# Enable DHCP.

[Device] dhcp enable

# Enable recording of relay entries on the delay agent.

[Device] dhcp relay client-information record

# Enable the DHCP relay agent on Ten-GigabitEthernet 0/0/15.

[Device] interface ten-gigabitethernet 0/0/15

[Device-Ten-GigabitEthernet0/0/15] dhcp select relay

# Specify the IP address of the DHCP server on the relay agent.

[Device-Ten-GigabitEthernet0/0/15] dhcp relay server-address 10.10.0.2

[Device-Ten-GigabitEthernet0/0/15] quit

# Enable IPv4SG on Ten-GigabitEthernet 0/0/15 and verify the source IP address and MAC address for dynamic IPv4SG.

[Device] interface ten-gigabitethernet 0/0/15

[Device-Ten-GigabitEthernet0/0/15] ip verify source ip-address mac-address

[Device-Ten-GigabitEthernet0/0/15] quit

Configuring DHCP clients

# Configure the DHCP clients to use DHCP for IP address acquisition. (Details not shown.)

Verifying the configuration

# Verify that the device has generated dynamic IPv4SG bindings for the clients based on DHCP relay entries.

<Device> display ip source binding dhcp-relay

Total entries found: 4

IP Address      MAC Address    Interface                VLAN Type

192.168.0.2     0001-0203-0402 XGE0/0/15                 N/A  DHCP relay

192.168.0.3     0001-0203-0403 XGE0/0/15                 N/A  DHCP relay

192.168.0.4     0001-0203-0404 XGE0/0/15                 N/A  DHCP relay

192.168.0.5     0001-0203-0405 XGE0/0/15                 N/A  DHCP relay

# Verify that the DHCP server can be pinged from the clients. (Details not shown.)

# Verify that the DHCP server cannot be pinged from the clients when the clients are assigned IP addresses manually. (Details not shown.)

Configuration files

#

 dhcp enable

 dhcp relay client-information record

#

interface Ten-GigabitEthernet0/0/15

 port link-mode route

 ip address 192.168.0.1 255.255.255.0

 dhcp select relay

 dhcp relay server-address 10.10.0.2

 ip verify source ip-address mac-address

#

interface Ten-GigabitEthernet0/0/16

 port link-mode route

 ip address 10.10.0.1 255.255.255.0

#

Related documentation

·     H3C CR16000-M1A Router Security Command Reference

·     H3C CR16000-M1A Router Security Configuration Guide