Chapter 9
| General Security Measures
IPv4 Source Guard
– 366 –
Command Mode
Interface Configuration (Ethernet)
Command Usage
◆ This command sets the maximum number of address entries that can be
mapped to an interface in the binding table for the specified mode (ACL
binding table or MAC address table) including dynamic entries discovered by
DHCP snooping and static entries set by the ip source-guard command.
◆ The maximum binding for ACL mode restricts the number of “active” entries
per port. If binding entries exceed the maximum number in IP source guard,
only the maximum number of binding entries will be set. Dynamic binding
entries exceeding the maximum number will be created but will not be active.
◆ The maximum binding for MAC mode restricts the number of MAC addresses
learned per port. Authenticated IP traffic with different source MAC addresses
cannot be learned if it would exceed this maximum number.
Example
This example sets the maximum number of allowed entries for ACL mode in the
binding table for port 5 to one entry. The mode is not specified, and therefore
defaults to the ACL binding table.
Console(config)#interface ethernet 1/5
Console(config-if)#ip source-guard max-binding 1
Console(config-if)#
ip source-guard mode This command sets the source-guard learning mode to search for addresses in the
ACL binding table or the MAC address binding table. Use the no form to restore the
default setting.
Syntax
ip source-guard mode {acl | mac}
no ip source-guard mode
mode - Specifies the learning mode.
acl - Searches for addresses in the ACL binding table.
mac - Searches for addresses in the MAC address binding table.
Default Setting
ACL
Command Mode
Interface Configuration (Ethernet)
To Next Page
Loading...
Need help?
General