ZyXEL Communications MES-2110, User Manual

Page: 119 / 184

MES-2110 User’s Guide
119
C
H A P T E R
17
IP Source Guard
17.1 Overview
IP source guard uses a binding table to distinguish between authorized and
unauthorized DHCP and ARP frames in your network. A binding contains these key
attributes:
• MAC address
• VLAN ID
• IP address
• Port number
When the Switch receives a DHCP or ARP frame, it looks up the appropriate MAC
address, VLAN ID, IP address, and port number in the binding table. If there is a
binding, the Switch forwards the frame. If there is not a binding, the Switch
discards the frame.
The Switch builds the binding table by snooping DHCP frames (dynamic bindings)
and from information provided manually by administrators (static bindings).
IP source guard consists of the following features:
• Static bindings. Use this to create static bindings in the binding table.
• DHCP snooping. Use this to filter unauthorized DHCP frames on the network and
to build the binding table dynamically.
• ARP inspection. Use this to filter unauthorized ARP frames on the network.
If you want to use dynamic bindings to filter unauthorized ARP frames (typical
implementation), you have to enable DHCP snooping before you enable ARP
inspection.
17.1.1 DHCP Snooping Overview
Use DHCP snooping to filter unauthorized DHCP frames on the network and to
build the binding table dynamically. This can prevent clients from getting IP
addresses from unauthorized DHCP servers.