Edge-Core ECS4660-28F, Руководство по управлению, Страница: 1135 / 2020

C
HAPTER
29
| General Security Measures
IPv4 Source Guard
– 1135 –
■
If there is an entry with same VLAN ID and MAC address, and the
type of entry is static IP source guard binding, then the new entry
will replace the old one.
■
If there is an entry with same VLAN ID and MAC address, and the
type of the entry is dynamic DHCP snooping binding, then the new
entry will replace the old one and the entry type will be changed to
static IP source guard binding.
E
XAMPLE
This example configures a static source-guard binding on port 5. Since the
binding mode is not specified, the entry is bound to the ACL table by
default.
Console(config)#ip source-guard binding 00-ab-11-cd-23-45 vlan 1 192.168.0.99
interface ethernet 1/5
Console(config)#
R
ELATED
C
OMMANDS
ip source-guard (1135)
ip dhcp snooping (1116)
ip dhcp snooping vlan (1121)
ip source-guard
This command configures the switch to filter inbound traffic based on
source IP address, or source IP address and corresponding MAC address.
Use the no form to disable this function.
S
YNTAX
ip source-guard { sip | sip-mac }
no ip source-guard
sip - Filters traffic based on IP addresses stored in the binding
table.
sip-mac - Filters traffic based on IP addresses and corresponding
MAC addresses stored in the binding table.
D
EFAULT
S
ETTING
Disabled
C
OMMAND
M
ODE
Interface Configuration (Ethernet)
C
OMMAND
U
SAGE
◆
Source guard is used to filter traffic on an insecure port which receives
messages from outside the network or fire wall, and therefore may be
subject to traffic attacks caused by a host trying to use the IP address
of a neighbor.