153
IP source guard configuration
The switch operates in IRF or standalone (the default) mode. For information about the IRF mode, see
IRF
in
the
IRF Configuration Guide
.
IP source guard overview
IP source guard is intended to work on a port connecting users. It filters received packets to block
illegal access to network resources, improving the network security. For example, it can prevent
illegal hosts from using a legal IP address to access the network.
After receiving a packet, the IP source guard enabled port obtains the key attributes (including IP
address, MAC address and VLAN tag) of the packet and then looks them up in the binding entries
of the IP source guard. See Figure 51. If there is a match, the port forwards the packet. Otherwise,
the port discards the packet. IP source guard bindings are on a per-port basis. After a binding
entry is configured on a port, it is effective only on the port.
Figure 51
Diagram for the IP source guard function
IP source guard filters packets based on the following types of binding entries:
•
IP-port binding entry
•
MAC-port binding entry
•
IP-MAC-port binding entry
•
IP-VLAN-port binding entry
•
MAC-VLAN-port binding entry
•
IP-MAC-VLAN-port binding entry
An IP source guard binding entry can be static or dynamic, depending on how the entry is
created.
•
A static binding is configured manually. It is suitable when there are a few hosts in a LAN or
you need to configure a binding entry for a host separately.
