Chapter 12
| Security Measures
IPv4 Source Guard
– 370 –
Figure 225: Setting the Filter Type for IPv4 Source Guard
Configuring
Static Bindings
forIPv4Source Guard
Use the Security > IP Source Guard > Static Configuration (Configure ACL Table and
Configure MAC Table) pages to bind a static address to a port. Table entries include
a MAC address, IP address, lease time, entry type (Static, Dynamic), VLAN identifier,
and port identifier. All static entries are configured with an infinite lease time,
which is indicated with a value of zero in the table.
Command Usage
◆ Table entries include a MAC address, IP address, lease time, entry type (Static-IP-
SG-Binding, Dynamic-DHCP-Binding), VLAN identifier, and port identifier.
◆ Static addresses entered in the source guard binding table are automatically
configured with an infinite lease time.
◆ When source guard is enabled, traffic is filtered based upon dynamic entries
learned via DHCP snooping, or static addresses configured in the source guard
binding table.
◆ Static bindings are processed as follows:
■
A valid static IP source guard entry will be added to the binding table in
ACL mode if one of the following conditions is true:
■
If there is no entry with the same VLAN ID and MAC address, a new
entry is added to the binding table using the type “static IP source
guard binding.”
■
If there is an entry with the same VLAN ID and MAC address, and the
type of entry is static IP source guard binding, then the new entry will
replace the old one.
■
If there is an entry with the same VLAN ID and MAC address, and the
type of the entry is dynamic DHCP snooping binding, then the new
entry will replace the old one and the entry type will be changed to
static IP source guard binding.
To Next Page
Loading...
Need help?
General