250
A static IPv4 source guard binding entry filters IPv4 packets received by the port or checks the
validity of users by cooperating with the ARP detection feature.
A static IPv6 source guard binding entry filters IPv6 packets received by the port or checks the
validity of users by cooperating with the ND detection feature.
NOTE:
For information about ARP detection, see the chapter “ARP attack protection configuration.”
For information about ND detection, see the chapter “ND attack defense configuration.”
2.
Validity ranges of static IP source guard binding entries
According to the validity range, a static IP source guard binding entry is a global or port-based static
binding entry:
A global static binding entry is effective on all ports. A port forwards a packet only when the
packet’s IP address and MAC address both matches those in a global static binding entry or both
do not match those in any global static binding entry. If only the IP address or MAC address of the
packet matches that of a global static binding entry, the port discards the packet. Global static
binding entries are used to protect against host spoofing attacks. They can effectively filter attack
packets that exploit the IP address or MAC address of a legal user host.
A port-based static binding entry is effective on only the specified port. A port forwards a packet
only when the IP address, and MAC address of the packet all match those in a static binding entry
on the port. All other packets will be dropped. Port-based static binding entries are used to check
the validity of users that are trying to access a port.
NOTE:
Global static IP source guard binding entries take effect on all ports. However, port-based static IP
source guard binding entries and dynamic IP source guard binding entries take precedence over global
static IP source guard binding entries. If a port is configured with a static binding entry or dynamic
binding, the global static binding entries do not take effect on the port.
3.
Excluded ports of global static binding entries
In some circumstances, global static binding entries may result in communication failures on some ports.
In such cases, specify the ports as excluded ports, so that global static binding entries do not take effect
on these ports.
As shown in
, Device B is an access layer device connected to hosts of different VLANs. Device
A works at the distribution layer as a gateway to allow hosts in different VLANs to communicate at Layer
3. When a host in a VLAN communicates with a host in another VLAN, Device A forwards IP packets
between the VLANs, changing the source MAC addresses of the IP packets. For example, when Device A
receives an IP packet from Host A to Host B, it changes the source MAC address of the IP packet from
0001-0203-0406 to 0001-0202-0202, its own MAC address. If you configure a global static binding
entry with Host A’s IP address and MAC address, Device B will drop the packets because the packets’ IP
address matches the entry but their source MAC address does not match the entry, preventing hosts in
different VLANs from communicating at Layer 3.
To solve the problem, specify the uplink port (GE1/0/1) of Device B as an excluded port for global static
binding. Then, the global static binding entry does not take effect on the uplink port, and packets
forwarded by Device A will be forwarded normally.
