ZyXEL Communications OLT2406, User Manual

Page: 548 / 766

Chapter 77 IP Source Guard
OLT2406 User’s Guide
548
C
HAPTER
77
IP Source Guard
77.1 IP Source Guard Overview
Use IP source guard to filter unauthorized DHCP and ARP packets in your network.
IP source guard uses a binding table to distinguish between authorized and unauthorized DHCP and
ARP packets in your network. A binding contains these key attributes:
• MAC address
• VLAN ID
• IP address
• Port number
When the OLT receives a DHCP or ARP packet, it looks up the appropriate MAC address, VLAN ID, IP
address, and port number in the binding table. If there is a binding, the OLT forwards the packet. If there
is not a binding, the OLT discards the packet.
The OLT builds the binding table by snooping DHCP packets (Dynamic bindings) and from information
provided manually by administrators (Static bindings).
IP source guard consists of the following features:
• Static bindings. Use this to create static bindings in the binding table.
• DHCP snooping. Use this to filter unauthorized DHCP packets on the network and to build the binding
table dynamically.
• ARP inspection. Use this to filter unauthorized ARP packets on the network.
If you want to use dynamic bindings to filter unauthorized ARP packets (Typical implementation), you
have to enable DHCP snooping before you enable ARP inspection.
77.1.1 DHCP Snooping Overview
Use DHCP snooping to filter unauthorized DHCP packets on the network and to build the binding table
dynamically. This can prevent clients from getting IP addresses from unauthorized DHCP servers.
77.1.1.1 Trusted vs. Untrusted Ports
Every port is either a trusted port or an untrusted port for DHCP snooping. This setting is independent of
the trusted/untrusted setting for ARP inspection. You can also specify the maximum number for DHCP
packets that each port (Trusted or untrusted) can receive each second.