Tripp Lite NGI-M05-C1, Owner'S Manual, Page: 165 / 254

165
7. Security
7.1. IP Source Guard
IP Source Guard is a security feature that restricts IP traffic on un-trusted Layer 2 ports by
filtering traffic based on the DHCP snooping binding database or manually configured IP
source bindings. This feature helps prevent IP spoofing attacks when a host tries to spoof
and use the IP address of another host. Any IP traffic coming into the interface with a
source IP address other than that assigned (via DHCP or static configuration) will be
filtered out on the un-trusted Layer 2 ports.
The IP Source Guard feature is enabled in combination with the DHCP snooping feature
on un-trusted Layer 2 interfaces. It builds and maintains an IP source binding table that is
learned by DHCP snooping or manually configured (static IP source bindings). An entry
in the IP source binding table contains the IP address and the associated MAC and VLAN
numbers. The IP Source Guard is supported on Layer 2 ports only, including access and
trunk ports.
The IP Source Guard features include below functions:
1. DHCP Snooping.
2. DHCP Binding table.
3. ARP Inspection.
4. Blacklist Filter. (arp-inspection mac-filter table)
7.1.1. DHCP Snooping
DHCP snooping is a DHCP security feature that provides network security by filtering un-
trusted DHCP messages and by building and maintaining a DHCP snooping binding
database, which is also referred to as a DHCP snooping binding table.
DHCP snooping acts like a firewall between un-trusted hosts and DHCP servers. You can
use DHCP snooping to differentiate between un-trusted interfaces connected to the end
user and trusted interfaces connected to the DHCP server or another switch.
The DHCP snooping binding database contains the MAC address, the IP address, the lease
time, the binding type, the VLAN number, and the interface information that corresponds
to the local un-trusted interfaces of a switch.
When a switch receives a packet on an un-trusted interface and the interface belongs to a
VLAN in which DHCP snooping is enabled, the switch compares the source MAC address
and the DHCP client hardware address. If addresses match (the default), the switch
forwards the packet. If the addresses do not match, the switch drops the packet.
The switch drops a DHCP packet when one of these situations occurs:

A packet from a DHCP server, such as a DHCPOFFER, DHCPACK, DHCPNAK,
or DHCPLEASEQUERY packet, is received from the un-trusted port.