Cisco Catalyst 4500 Series - Configuring IP Source Guard on Private Vlans

60-22
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 60 Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts
Displaying IP Source Guard Information
Switch# show ip verify source interface f6/1
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- ----------------- ----------
Fa6/1 ip-mac active 10.0.0.1 10
Fa6/1 ip-mac active deny-all 11-20
Switch#
The output shows that there is one valid DHCP binding to VLAN 10.
Configuring IP Source Guard on Private VLANs
For IP source guard to be effective on PVLAN ports, you must enable DHCP snooping on primary
VLANs. IP source guard on a primary VLAN is automatically propagated to a secondary VLAN. You
can configure static IP source binding on a secondary VLAN, but it does not work. When manually
configuring a static IP source binding on a secondary VLAN, you receive the following message:
IP source filter may not take effect on a secondary VLAN where IP source binding is
configured. If the private VLAN feature is enabled, IP source filter on the primary VLAN
will automatically propagate to all secondary VLAN.
Note IP Source Guard is supported on private VLAN host ports only.
Displaying IP Source Guard Information
You can display IP source guard PVACL information for all interfaces on a switch using the
show ip verify source command, as the following examples show:
• This example shows displayed PVACLs if DHCP snooping is enabled on VLAN 10 through 20, if
interface fa6/1 is configured for IP filtering, and if there is an existing IP address binding 10.0.01
on VLAN 10:
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- -------------- ---------
fa6/1 ip active 10.0.0.1 10
fa6/1 ip active deny-all 11-20
Note The second entry shows that a default PVACL (deny all IP traffic) is installed on the port for those
snooping-enabled VLANs that do not have a valid IP source binding.
• This example shows displayed PVACL for a trusted port:
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- -------------- ---------
fa6/2 ip inactive-trust-port
• This example shows displayed PVACL for a port in a VLAN not configured for DHCP snooping:
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- -------------- ---------
fa6/3 ip inactive-no-snooping-vlan