Enabling ip source guard on a port, Defining static ip source bindings – Brocade Communications Systems Brocade ICX 6650 6650 User Manual
Page 316
296
Brocade ICX 6650 Security Configuration Guide
53-1002601-01
IP source guard
•
64 rules per ACL
•
The number of configured ACL rules affect the rate at which hardware resources are used
when IP Source Guard is enabled. Use the show access-list hw-usage on command to enable
hardware usage for an ACL, followed by a show access-list access-list-id command to
determine the hardware usage for an ACL.
Example
Brocade# show access-list hw-usage on
Brocade# show access-list 100
Extended IP access list 100 (hw usage : 2)
deny ip any any (hw usage : 1)
To provide more hardware resource for IP Source Guard addresses, modify the ACL rules so
that it uses less hardware resource.
•
If you enable IP Source Guard in a network topology that has DHCP clients, you must also
enable DHCP snooping. Otherwise, all IP traffic including DHCP packets will be blocked.
•
When you enable IP Source Guard in a network topology that does not have DHCP clients, you
must create an IP source binding for each client that will be allowed access to the network.
Otherwise, data packets will be blocked. Refer to
“Defining static IP source bindings”
•
Source Guard Protection enables concurrent support with multi-device port authentication. For
details, Refer to
“Enabling source guard protection”
•
IP Source Guard is supported on a VE with or without an assigned IP address.
Enabling IP source guard on a port
You can enable IP Source Guard on DHCP snooping untrusted ports. Refer to
page 283 for how to configure DHCP and DHCP untrusted ports.
By default, IP Source Guard is disabled. To enable IP Source Guard on a DHCP untrusted port, enter
the following commands.
Brocade(config)# interface ethernet 1/1/4
Brocade(config-if-e10000-1/1/4)# source-guard enable
The commands change the CLI to the interface configuration level for port 1/1/4 and enable IP
Source Guard on the port.
Syntax: [no] source-guard enable
Defining static IP source bindings
You can manually enter valid IP addresses in the binding database. To do so, enter a command
such as the following.
Brocade(config)# ip source binding 10.10.10.1 ethernet 1/2/4 vlan 4
Syntax: [no] ip source binding ip-addr ethernet stack-iunit/slotnum/portnum [vlan vlannum]
For ip-addr, enter a valid IP address.