H3C H3C S5100-SI, Operation Manual, Page: 364 / 830

3-10
Configuring IP Filtering
Follow these steps to configure IP filtering:
To do… Use the command… Remarks
Enter system view system-view —
Enter Ethernet port view
interface interface-type
interface-number
—
Enable IP filtering
ip check source ip-address
[ mac-address ]
Required
By default, this function is
disabled.
Create a static binding
ip source static binding
ip-address ip-address
[ mac-address mac-address ]
Optional
By default, no static binding
entry is created.
z
Enable DHCP snooping and specify trusted ports on the switch before configuring IP filtering.
z
You are not recommended to configure IP filtering on the ports of an aggregation group.
z
To create a static binding after IP filtering is enabled with the mac-address keyword specified on a
port, the mac-address argument must be specified; otherwise, the packets sent from this IP
address cannot pass the IP filtering.
z
A static entry has a higher priority than the dynamic DHCP snooping entry that has the same IP
address as the static one. That is, if the static entry is configured after the dynamic entry is
recorded, the static entry overwrites the dynamic entry; if the static entry is configured before
DHCP snooping is enabled, no DHCP client can obtain the IP address of the static entry, that is, the
dynamic DHCP snooping entry cannot be generated.
z
The VLAN ID of the IP static binding configured on a port is the VLAN ID of the port.
Displaying DHCP Snooping Configuration
To do… Use the command… Remarks
Display the user IP-MAC
address mapping entries
recorded by the DHCP
snooping function
display dhcp-snooping [ unit
unit-id ]
Display the (enabled/disabled)
state of the DHCP snooping
function and the trusted ports
display dhcp-snooping trust
Display the IP static binding
table
display ip source static
binding
[ vlan vlan-id |
interface interface-type
interface-number
]
Available in any view