Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1603 / 2086

60-21
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 60 Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts
Configuring IP Source Guard
If you want to stop IP source guard with static hosts on an interface, use the following commands in
interface configuration submode:
Switch(config-if)# no ip verify source
Switch(config-if)# no ip device tracking max
If the no ip device tracking command is used in interface configuration submode, it actually runs in
global configuration mode and causes IP device tracking to be disabled globally. Disabling IP device
tracking globally causes IP source guard with static hosts to deny all IP traffic on interfaces using the
ip
verify source tracking [ port-security ] command.
Note The static IP source binding can only be configured on switch port. If you enter the
ip source binding vlan interface command on a Layer 3 port, you receive this error message:
Static IP source binding can only be configured on switch port
.
This example shows how to enable per-Layer 2 port IP source guard on VLAN 10 through 20:
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10 20
Switch(config)# interface fa6/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 10
Switch(config-if)# switchport trunk allowed vlan 11-20
Switch(config-if)# no ip dhcp snooping trust
Switch(config-if)# ip verify source vlan dhcp-snooping
Switch(config)# end
Step 3
Switch(config-if)# no ip dhcp snooping trust
Configures the interface as trusted or untrusted.
You can use the no keyword of to configure an interface
to receive only messages from within the network.
Step 4
Switch(config-if)# ip verify source vlan
dhcp-snooping port-security
Enables IP source guard, source IP, and source MAC
address filtering on the port.
Step 5
Switch(config-if)# switchport port-security limit
rate invalid-source-mac N
Enables security rate limiting for learned source MAC
addresses on the port.
Note
This limit only applies to the port where IP
source guard is enabled as filtering both IP and
MAC addresses.
Step 6
Switch(config)# ip source binding mac-address
Vlan vlan-id ip-address interface interface-name
Configures a static IP binding on the port.
Step 7
Switch(config)# end
Exits configuration mode.
Step 8
Switch# show ip verify source interface
interface-name
Verifies the configuration.
Command Purpose