Web-based Configuration Guide
Security
109
7.6
IP Source Guard
7.6.1
Overview
After the IP Source Guard function is enabled, the device checks IP packets from DHCP non-trusted ports. You
can configure the device to check only the IP field or IP+MAC field to filter out IP packets not matching the
binding list. It can prevent users from setting private IP addresses and forging IP packets.
Caution
IP Source Gusrd should be enabled together with DHCP snooping. Otherwise, IP packet forwarding may be
affected. To configure DHCP Snooping function, see
7.6.2
Viewing Binding List
Choose
Local Device
>
Security
>
IP Source Guard
>
Binding List
.
The binding list is the basis for IP Source Guard. Currently, data in
Binding List
is sourced from dynamic
learning results of DHCP snooping binding database. When IP Source Guard is enabled, data of the DHCP
Snooping binding database is synchronized to the binding list of IP Source Guard. In this case, IP packets are
filtered strictly through IP Source Guard on devices with DHCP Snooping enabled.
Click
Refresh
to obtain the latest data in
Binding List
.
The search box in the upper-right corner supports finding the specified entry in
Binding List
based on IP
addresses, MAC addresses, VLANs or ports. Click the drop-down list box to select the search type, enter the
search string, and click
Search
.
