HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

407
Hardware IPv4 source guard function IPv4 binding entries
Configured on
multiple ports
MSR50
Yes on MSR50 routers installed
with FIC-FSW or DFIC-FSW
modules
Yes Yes
MSR1000
Yes on Layer 2 fixed Ethernet
ports
Yes
Layer 2 fixed Ethernet ports
support only static MAC-port
binding entries.
Yes
NOTE:
You cannot configure the IP source guard function on a port in an aggregation group, or vice versa.
Enabling IPv4 source guard on a port
The IPv4 source guard function must be enabled on a port before the port can obtain dynamic IPv4
source guard binding entries and use static and dynamic IPv4 source guard binding entries to filter
packets.
• For information about how to configure a static binding entry, see "Configuring a static IPv4
so
urce guard binding entry."
• On a Layer 2 Ethernet port, IP source guard cooperates with DHCP snooping to obtain the
DHCP snooping entries dynamically generated during dynamic IP address allocation, and uses
the DHCP snooping entries to generate IP source guard binding entries.
Dynamic IPv4 source guard binding entries can contain such information as the MAC address, IP
address, VLAN tag, ingress port information, and entry type (DHCP snooping), where the MAC
address, IP address, or VLAN tag information might not be included depending on your configuration.
IP source guard applies these entries to the port to filter packets.
Follow these guidelines when you enable IPv4 source guard on a port:
• If you configure the ip verify source command on a port multiple times, the most recent
configuration takes effect.
• To generate IPv4 source guard binding entries dynamically based on DHCP entries, make sure
DHCP snooping is configured and working correctly. For information about DHCP snooping
configuration, see HPE FlexNetwork MSR Router Series Comware 5 Layer 3—IP Services
Configuration Guide.
To enable IPv4 source guard on a port:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter interface view.
interface
interface-type
interface-number
N/A
3. Enable IPv4 source guard
on the port.
ip verify source
{
ip-address
|
ip-address mac-address
|
mac-address
}
Disabled by default.

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English