PLANET SGSD-1022 - Manual (Page 330)

User’s Manual of SGSD-1022 / SGSD-1022P
SGSW-2840 / SGSW-2840P
4.11.16 IP Source Guard
IP Source Guard is a security feature that filters IP traffic on network interfaces based on manually configured entries in the IP
Source Guard table, or dynamic entries in the DHCP Snooping table when enabled (see “ DHCP Snooping ”). IP source guard
can be used to prevent traffic attacks caused when a host tries to use the IP address of a neighbor to access the network. This
section describes commands used to configure IP Source Guard.
4.11.16.1 Port Configuration
IP Source Guard is used to filter traffic on an unsecure port which receives messages from outside the network or firewall, and
therefore may be subject to traffic attacks caused by a host trying to use the IP address of a neighbor.
Command Usage
• Setting source guard mode to SIP (Source IP) or SIP-MAC (Source IP and MAC) enables this function on the selected port.
Use the SIP option to check the VLAN ID, source IP address, and port number against all entries in the binding table. Use the
SIP-MAC option to check these same parameters, plus the source MAC address. If no matching entry is found, the packet is
dropped.
• When enabled, traffic is filtered based upon dynamic entries learned via DHCP snooping (see “ Configuring DHCP
Snooping ”), or static addresses configured in the source guard binding table.
• If IP source guard is enabled, an inbound packet’s IP address (sip option) or both its IP address and corresponding MAC
address (sip-mac option) will be checked against the binding table. If no matching entry is found, the packet will be dropped.
• Filtering rules are implemented as follows:
- If the DHCP snooping is disabled, IP source guard will check the VLAN ID, source IP address, port number, and
source MAC address (for the sip-mac option). If a matching entry is found in the binding table and the entry type is
static IP source guard binding, the packet will be forwarded.
- If the DHCP snooping is enabled, IP source guard will check the VLAN ID, source IP address, port number, and
source MAC address (for the sip-mac option). If a matching entry is found in the binding table and the entry type is
static IP source guard binding, or dynamic DHCP snooping binding, the packet will be forwarded.
- If IP source guard if enabled on an interface for which IP source bindings have not yet been configured (neither by
static configuration in the IP source guard binding table nor dynamically learned from DHCP snooping), the switch will
drop all IP traffic on that port, except for DHCP packets.
330