Table of Contents

1 IP Source Guard Configuration· 1-1

IP Source Guard Overview· 1-1

Configuring a Static Binding Entry· 1-2

Configuring Dynamic Binding Function· 1-2

Displaying IP Source Guard· 1-2

IP Source Guard Configuration Examples· 1-3

Static Binding Entry Configuration Example· 1-3

Dynamic Binding Function Configuration Example· 1-4

Troubleshooting· 1-6

Failed to Configure Static Binding Entries and Dynamic Binding Function· 1-6

 

 

 

When configuring IP Source Guard, go to these sections for information you are interested in:

l          IP Source Guard Overview

l          Configuring a Static Binding Entry

l          Configuring Dynamic Binding Function

l          Displaying IP Source Guard

l          IP Source Guard Configuration Examples

l          Troubleshooting

IP Source Guard Overview

By filtering packets on a per-port basis, IP source guard prevents packets with illegal IP addresses and MAC addresses from traveling through, improving the network security. After receiving a packet, the port looks up the key attributes (including IP address, MAC address and VLAN tag) of the packet in the binding entries of the IP source guard. If there is a matching entry, the port will forward the packet. Otherwise, the port will abandon the packet.

IP source guard filters packets based on the following types of binding entries:

l          IP-port binding entry

l          MAC-port binding entry

l          IP-MAC-port binding entry

You can manually set static binding entries, or use DHCP Snooping to provide dynamic binding entries. Binding is on a per-port basis. After a binding entry is configured on a port, it is effective only to the port, instead of other ports.

 

 

Configuring a Static Binding Entry

Follow these steps to configure a static binding entry:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Enter interface view	interface interface-type interface-number	—
Configure a static binding entry	user-bind { ip-address ip-address | ip-address ip-address mac-address mac-address | mac-address mac-address }	Required No static binding entry exists by default.

 

 

Configuring Dynamic Binding Function

After the dynamic binding function is enabled on a port, IP source guard will receive and process corresponding DHCP Snooping entries, which contain such information as MAC address, IP address, VLAN tag, port information or entry type. It adds the obtained information to the dynamic binding entries to enable the port to filter packets according to the binding entries.

Follow these steps to configure dynamic binding function:

To do…	Use the command…	Remarks
Enter system view	system-view	—
Enter interface view	interface interface-type interface-number	—
Configure dynamic binding function	ip check source { ip-address | ip-address mac-address | mac-address }	Required Not configured by default

 

Displaying IP Source Guard

To do…	Use the command…	Remarks
Display information about static binding entries	display user-bind [ interface interface-type interface-number | ip-address ip-address | mac-address mac-address ]	Available in any view
Display information about dynamic binding entries	display ip check source [ interface interface-type interface-number | ip-address ip-address | mac-address mac-address ]	Available in any view

 

IP Source Guard Configuration Examples

Static Binding Entry Configuration Example

Network requirements

As shown in Figure 1-1, an access controller (AC), a switch and Hosts A, B and C are on an Ethernet. Host A and Host B are connected to ports GigabitEthernet1/0/1 and GigabitEthernet 1/0/2 of the switch respectively, Host C is connected to port GigabitEthernet 0/0/2 of the AC, while the switch is connected to port GigabitEthernet 0/0/1 of the AC.

Detailed requirements are as follows:

l          On port GigabitEthernet 0/0/2 of AC, only IP packets with the source MAC address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 can pass.

l          On port GigabitEthernet 0/0/1 of AC, only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.

l          On port GigabitEthernet 1/0/1 of Switch, only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.

l          On port GigabitEthernet 1/0/2 of Switch, only IP packets with the source MAC address of 00-01-02-03-04-07 and the source IP address of 192.168.0.2 can pass.

Network diagram

Figure 1-1 Network diagram for configuring static binding entries

 

Configuration procedure

1)        Configure AC

# Configure the IP addresses of various interfaces (omitted).

# Configure port GigabitEthernet 0/0/2 of AC to allow only IP packets with the source MAC address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 to pass.

<AC> system-view

[AC] interface GigabitEthernet 0/0/2

[AC-GigabitEthernet0/0/2] user-bind ip-address 192.168.0.3 mac-address 0001-0203-0405

[AC-GigabitEthernet0/0/2] quit

# Configure port GigabitEthernet 0/0/1 of AC to allow only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.

[AC] interface GigabitEthernet 0/0/1

[AC-GigabitEthernet0/0/1] user-bind ip-address 192.168.0.1 mac-address 0001-0203-0406

2)        Configure Switch

# Configure the IP addresses of various interfaces (omitted).

# Configure port GigabitEthernet 1/0/1 of Switch to allow only IP packets with the source MAC address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.

<Switch> system-view

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] user-bind ip-address 192.168.0.1 mac-address 0001-0203-0406

[Switch-GigabitEthernet1/0/1] quit

# Configure port GigabitEthernet 1/0/2 of Switch to allow only IP packets with the source MAC address of 00-01-02-03-04-07 and the source IP address of 192.168.0.2 to pass.

[Switch] interface gigabitethernet 1/0/2

[Switch-GigabitEthernet1/0/2] user-bind ip-address 192.168.0.2 mac-address 0001-0203-0407

3)        Verify the configuration

# On AC, static binding entries are configured successfully.

<AC> display user-bind

The following user address bindings have been configured:

 MAC               IP               Vlan   Port                         Status

 0001-0203-0405      192.168.0.3           N/A    GigabitEthernet0/0/2                 Static

 0001-0203-0406      192.168.0.1           N/A    GigabitEthernet0/0/1                 Static

------------------2 binding entries queried, 2 listed------------------

# On Switch, static binding entries are configured successfully.

<Switch> display user-bind

The following user address bindings have been configured:

MAC               IP               Vlan   Port                         Status

 0001-0203-0406     192.168.0.1          N/A      GigabitEthernet1/0/1                 Static

 0001-0203-0407     192.168.0.2          N/A      GigabitEthernet1/0/2                 Static

------------------2 binding entries queried, 2 listed------------------

Dynamic Binding Function Configuration Example

Network requirements

AC connects to Client and DHCP Server through GigabitEthernet 0/0/1 and GigabitEthernet 0/0/2 respectively. DHCP Snooping is enabled on AC.

Detailed requirements are as follows:

l          Client (with the MAC address of 00-01-02-03-04-06) obtains an IP address through the DHCP Server.

l          On AC, create the DHCP Snooping entry of Client.

l          On port GigabitEthernet 0/0/1 of AC, enable dynamic binding function to prevent attacks from using forged IP addresses to attack the server.

 

 

Network diagram

Figure 1-2 Network diagram for configuring dynamic binding

 

Configuration procedure

1)        Configure AC

# Configure dynamic binding on port GigabitEthernet 0/0/1.

<AC> system-view

[AC] interface GigabitEthernet 0/0/1

[AC-GigabitEthernet0/0/1] ip check source ip-address mac-address

[AC-GigabitEthernet0/0/1] quit

# Enable DHCP snooping on Switch A.

[AC] dhcp-snooping

# Configure port GigabitEthernet 0/0/2 connected to the DHCP server as a trusted port.

[AC] interface GigabitEthernet0/0/2

[AC-GigabitEthernet0/0/2] dhcp-snooping trust

[AC-GigabitEthernet0/0/2] quit

2)        Verify the configuration

# Display the dynamic binding entries that port GigabitEthernet 0/0/1 has obtained from DHCP Snooping.

<AC> display ip check source

The following user address bindings have been configured:

 MAC               IP               Vlan   Port                         Status

 0001-0203-0406     192.168.0.1         1      GigabitEthernet0/0/1              DHCP-SNP

 -----------------1 binding entries queried, 1 listed------------------

# Display the dynamic entries of DHCP Snooping and check it is identical with the dynamic entries that port GigabitEthernet 0/0/1 has obtained.

<AC> display dhcp-snooping

DHCP Snooping is enabled.

The client binding table for all untrusted ports.

Type : D--Dynamic , S--Static

Type IP Address      MAC Address    Lease        VLAN Interface

==== =============== ============== ============ ==== =================

D    192.168.0.1     0001-0203-0406 86335        1    GigabitEthernet0/0/1

As you see, port GigabitEthernet 0/0/1 has obtained the dynamic entries generated by DHCP Snooping after it is configured with dynamic binding function.

Troubleshooting

Failed to Configure Static Binding Entries and Dynamic Binding Function

Symptom

Configuring static binding entries and dynamic binding function fails on a port.

Analysis

IP Source Guard is not supported on the port which has joined an aggregation group. Neither static binding entries nor dynamic binding function can be configured on the port which has joined an aggregation group.

Solution

Remove the port from the aggregation group.