Security Measures
183
Instruction Manual - NXA-ENET8-POE+
IPv4 Source Guard
IPv4 Source Guard is a security feature that filters IP traffic on network interfaces based on manually configured entries in the IP
Source Guard table, or dynamic entries in the DHCP Snooping table when enabled (see the
IP source guard can be used to prevent traffic attacks caused when a host tries to use the IPv4 address of a neighbor to access the
network. This section describes how to configure IPv4 Source Guard.
Configuring Ports for IPv4 Source Guard
Use the Security > IP Source Guard > General page to set the filtering type based on source IP address, or source IP address and
MAC address pairs. It also specifies lookup within the ACL binding table or the MAC address binding table, as well as the maximum
number of allowed binding entries for the lookup tables.
IP Source Guard is used to filter traffic on an insecure port which receives messages from outside the network or fire wall, and
therefore may be subject to traffic attacks caused by a host trying to use the IP address of a neighbor.
Command Usage
Filter Type
Setting source guard mode to SIP (Source IP) or SIP-MAC (Source IP and MAC) enables this function on the selected port.
Use the SIP option to check the VLAN ID, source IP address, and port number against all entries in the binding table. Use
the SIP-MAC option to check these same parameters, plus the source MAC address. If no matching entry is found, the
packet is dropped.
NOTE:
Multicast addresses cannot be used by IP Source Guard.
When enabled, traffic is filtered based upon dynamic entries learned via DHCP snooping (see the
page 177), or static addresses configured in the source guard binding table.
If IP source guard is enabled, an inbound packet's IP address (SIP option) or both its IP address and corresponding MAC
address (SIP-MAC option) will be checked against the binding table. If no matching entry is found, the packet will be
dropped.
An entry with same MAC address and a different VLAN ID cannot be added to the binding table.
Filtering rules are implemented as follows:
If DHCP snooping is disabled (see page 178), IP source guard will check the VLAN ID, source IP address, port number,
and source MAC address (for the SIP-MAC option). If a matching entry is found in the binding table and the entry type
is static IP source guard binding, the packet will be forwarded.
If DHCP snooping is enabled, IP source guard will check the VLAN ID, source IP address, port number, and source MAC
address (for the SIP-MAC option). If a matching entry is found in the binding table and the entry type is static IP source
guard binding, or dynamic DHCP snooping binding, the packet will be forwarded.
If IP source guard is enabled on an interface for which IP source bindings have not yet been configured (neither by
static configuration in the IP source guard binding table nor dynamically learned from DHCP snooping), the switch will
drop all IP traffic on that port, except for DHCP packets allowed by DHCP snooping.
The following table lists the options on this page:
Security - IP Source Guard (General) Options
Filter Type
Configures the switch to filter inbound traffic based source IP address, or source IP address and
corresponding MAC address. (Default: None)
• Disabled - Disables IP source guard filtering on the port.
• SIP - Enables traffic filtering based on IP addresses stored in the binding table.
• SIP-MAC - Enables traffic filtering based on IP addresses and corresponding MAC addresses
stored in the binding table.
Filter Table
Sets the source guard learning model to search for addresses in the ACL binding table or the MAC
address binding table. (Default: ACL binding table)
Max Binding Entry
The maximum number of entries that can be bound to an interface. (ACL Table: 1-5, Default: 5;
MAC Table: 1-32, Default: 16)
This parameter sets the maximum number of address entries that can be mapped to an interface in
the binding table, including both dynamic entries discovered by DHCP snooping (see the
section on page 177) and static entries set by IP source guard (see the