ZyXEL Communications ONU-2024 Series, User Manual

Page: 159 / 268

ONU User’s Guide
159
C
H A P T E R
2 1
IP Source Guard
21.1 Overview
Use IP source guard to filter unauthorized ARP packets in your network.
IP source guard uses a binding table to distinguish between authorized and unauthorized ARP
packets in your network. A binding contains these key attributes:
• MAC address
• VLAN ID
• IP address
• Port number
When the ONU receives an ARP packet, it looks up the appropriate MAC address, VLAN ID,
IP address, and port number in the binding table. If there is a binding, the ONU forwards the
packet. If there is not a binding, the ONU discards the packet.
The ONU builds from information provided manually by administrators (static bindings).
IP source guard consists of the following features:
• Static bindings. Use this to create static bindings in the binding table.
• ARP inspection. Use this to filter unauthorized ARP packets on the network.
21.1.1 What You Can Do in the IP Source Guard Screens
• The IP Source Guard screen lets you look at the current bindings for ARP inspection
( Section 21.2 on page 161 ).
• The IP Source Guard Static Binding screen lets you manage static bindings for ARP
inspection ( Section 21.3 on page 162 ).
• The ARP Inspection Status screen lets you look at the current list of MAC address filters
that were created because the ONU identified an unauthorized ARP packet ( Section 21.4
on page 163 ).
• The ARP Inspection Log Status screen lets you look at log messages that were generated
by ARP packets and that have not been sent to the syslog server yet ( Section 21.4.1 on
page 164 ).
• The ARP Inspection Configure screen lets you enable ARP inspection on the ONU
( Section 21.5 on page 165 ).
• The ARP Inspection Port Configure screen lets you specify whether ports are trusted or
untrusted ports for ARP inspection ( Section 21.5.1 on page 167 ).