H3C Technologies H3C S5120 Series Switches - Manual (Page 728)

1-3
Displaying and Maintaining IP Source Guard
To do… Use the command… Remarks
Display information about static
binding entries
display user-bind [ interface
interface-type interface-number
| ip-address ip-address |
mac-address mac-address ]
Available in any view
Display information about
dynamic binding entries
display ip check source
[ interface interface-type
interface-number | ip-address
ip-address | mac-address
mac-address ]
Available in any view
IP Source Guard Configuration Examples
Static Binding Entry Configuration Example
Network requirements
As shown in Figure 1-1 , Host A and Host B are connected to ports GigabitEthernet 1/0/2 and
GigabitEthernet 1/0/1 of Switch B respectively, Host C is connected to port GigabitEthernet 1/0/2 of
Switch A, and Switch B is connected to port GigabitEthernet 1/0/1 of Switch A.
Configure static binding entries on Switch A and Switch B to meet the following requirements:
z On port GigabitEthernet 1/0/2 of Switch A, only IP packets from Host C can pass.
z On port GigabitEthernet 1/0/1 of Switch A, only IP packets from Host A can pass.
z On port GigabitEthernet 1/0/2 of Switch B, only IP packets from Host A can pass.
z On port GigabitEthernet 1/0/1 of Switch B, only IP packets from Host B can pass.
Figure 1-1 Network diagram for configuring static binding entries
Configuration procedure
1) Configure Switch A
# Configure the IP addresses of various interfaces (omitted).
# Configure port GigabitEthernet 1/0/2 of Switch A to allow only IP packets with the source MAC
address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 to pass.
<SwitchA> system-view
[SwitchA] interface GigabitEthernet 1/0/2
[SwitchA-GigabitEthernet1/0/2] user-bind ip-address 192.168.0.3 mac-address 0001-0203-0405