Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1606 / 2086

60-24
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 60 Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts
Configuring IP Source Guard for Static Hosts
Configuring IP Source Guard for Static Hosts
Note IPSG for static hosts should not be used on uplink ports.
IP source guard (IPSG) for static hosts extends the IPSG capability to non-DHCP and static
environments.
This section includes these topics:
• About IP Source Guard for Static Hosts, page 60-24
•
Configuring IPSG for Static Hosts on a Layer 2 Access Port, page 60-25
• Configuring IPSG for Static Hosts on a PVLAN Host Port, page 60-28
About IP Source Guard for Static Hosts
The prior feature, IPSG, uses the entries created by the DHCP snooping feature to validate the hosts
connected to a switch. Any traffic received from a host without a valid DHCP binding entry is dropped.
A DHCP environment is a prerequisite for IPSG to work. The IPSG for static hosts feature removes
IPSG’ dependency on DHCP. The switch creates static entries based on ARP requests or other IP packets
and uses them to maintain the list of valid hosts for a given port. In addition, you can specify the number
of hosts that would be allowed to send traffic to a given port. it is equivalent to port security at Layer 3.
Note
Some IP hosts with multiple network interfaces may inject some invalid packets into a network interface.
Those invalid packets contain the IP-to-MAC address for another network interface of that host as the
source address. It may cause IPSG for static hosts in the switch, which connects to the host, to learn the
invalid IP-to-MAC address bindings and reject the valid bindings. You should consult the vendor of the
corresponding operating system and the network device of that host to prevent it from injecting invalid
packets.
IPSG for static hosts initially learns IP-to-MAC bindings dynamically through an ACL-based snooping
method. IP-to-MAC bindings are learned from static hosts by using ARP and IP packets and are stored
using the device tracking database. Once the number of IP addresses that have been dynamically learned
or statically configured on a given port reaches a maximum limit, any packet with a new IP address is
dropped in hardware. To handle hosts that have moved or gone away for any reason, the IPSG for static
Table 60-3 show ip source binding Command Output
Field Description
MAC Address Client hardware MAC address
IP Address Client IP address assigned from the DHCP server
Lease (seconds) IP address lease time
Type Binding type; static bindings configured from CLI to dynamic binding
learned from DHCP snooping
VLAN VLAN number of the client interface
Interface Interface that connects to the DHCP client host