324
192.168.0.1 0001-0203-0406 Vlan100 100 DHCP relay
The output shows that a dynamic IPv4 source guard binding entry is generated based on a DHCP relay
entry.
Static IPv6 source guard configuration example
Network requirements
As shown in Figure 108, configure a static IPv6 source guard binding entry for Ten-GigabitEthernet
1/0/1 of the device to allow only IPv6 packets from the host to pass.
Figure 108 Network diagram
Configuration procedure
# Enable IPv6 source guard on Ten-GigabitEthernet 1/0/1.
<Switch> system-view
[Switch] interface ten-gigabitethernet 1/0/1
[Switch-Ten-GigabitEthernet1/0/1] ipv6 verify source ip-address mac-address
# On Ten-GigabitEthernet 1/0/1, configure a static IPv6 source guard binding entry for the host.
[Switch-Ten-GigabitEthernet1/0/1] ipv6 source binding ip-address 2001::1 mac-address
0001-0202-0202
[Switch-Ten-GigabitEthernet1/0/1] quit
# Display static IPv6 source guard binding entries on the device. The output shows that a static IPv6
source guard binding entry is configured successfully.
[Switch] display ipv6 source binding static
Total entries found: 1
IPv6 Address MAC Address Interface VLAN Type
2001::1 0001-0202-0202 XGE1/0/1 N/A Static
Dynamic IPv6 source guard using DHCPv6 snooping
configuration example
Network requirements
As shown in Figure 109:
• Enable DHCPv6 snooping on the device to record the IPv6 address and the MAC address of the
host in a DHCPv6 snooping entry.
• Enable dynamic IPv6 source guard on Ten-GigabitEthernet 1/0/1 to filter received packets based
on DHCPv6 snooping entries, allowing only packets from a client that obtains an IP address from
the DHCPv6 server to pass.
To Next Page
Loading...
