C
HAPTER
15
| Security Commands
IP Source Guard Commands
– 385 –
EXAMPLE
Security/Network/IP/Source/Guard>limit 2 2
Security/Network/IP/Source/Guard>
security network ip
source guard entry
This command binds a static address to a port.
SYNTAX
security network ip source guard entry [port-list] {add | delete}
vid allowed-ip ip-mask
port-list - A specific port or a range of ports. (Range: 1-28 or all)
add - Adds a static entry to the IP Source Guard table.
delete - Deletes a static entry from the IP Source Guard table.
vid - ID of a configured VLAN (Range: 1-4095)
allowed-ip - A valid unicast IP address, including classful types A, B
or C.
ip-mask - A subnet mask containing four integers from 0 to 255,
each separated by a period. The mask uses 1 bits to indicate
“match” and 0 bits to indicate “ignore.” The mask is bitwise ANDed
with the specified source IP address, and compared with the
address for each IP packet entering the port to which this entry
applies.
DEFAULT SETTING
No static entries are configured.
COMMAND USAGE
◆ Static addresses entered in the source guard binding table are
automatically configured with an infinite lease time. Dynamic entries
learned via DHCP snooping are configured by the DHCP server itself.
◆ Static bindings are processed as follows:
■
If there is no entry with the same VLAN ID and IP address, a new
entry is added to the static IP source guard binding table.
■
If there is an entry with the same VLAN ID and IP address, and the
type of entry is static IP source guard binding, then the new entry
will replace the old one.
■
If there is an entry with the same VLAN ID and IP address, and the
type of the entry is dynamic DHCP snooping binding, then the new
entry will replace the old one and the entry type will be changed to
static IP source guard binding.
■
Only unicast addresses are accepted for static bindings.
To Next Page
