HP 10500 series, Руководство по настройке безопасности

Страница: 433 / 596

419
Dynamic IPSG bindings
IPSG automatically obtains user information from other modules to generate dynamic bindings. The
source modules include 802.1X, DHCP relay, DHCP snooping, DHCPv6 snooping, and DHCP
server.
DHCP-based IPSG bindings are suitable for scenarios where hosts on a LAN obtain IP addresses
through DHCP. IPSG is configured on the DHCP snooping device or the DHCP relay agent. It
generates dynamic bindings based on the DHCP snooping entries or DHCP relay entries. IPSG
allows only packets from the DHCP clients to pass through.
Dynamic IPv4SG
Dynamic bindings generated based on different source modules are for different usages:
Interface types Source modules Binding usage
Layer 2 Ethernet port
DHCP snooping Packet filtering.
802.1X
For cooperation with modules (such as the
ARP detection module) to provide security
services.
Layer 3 Ethernet
interface/VLAN interface
DHCP relay agent Packet filtering.
DHCP server
For cooperation with modules (such as the
ARP detection module) to provide security
services.
For more information about 802.1X, see " Configuring 802.1X ." For information about DHCP
snooping, DHCP relay, and DHCP server see Layer 3—IP Services Configuration Guide .
Dynamic IPv6SG
IPv6SG on an interface obtains information from DHCPv6 snooping entries to generate bindings for
packet filtering.
For more information about DHCPv6 snooping, see Layer 3—IP Services Configuration Guide .
IPSG configuration task list
To configure IPv4SG, perform the following tasks:
Tasks at a glance
(Required.) Enabling IPv4SG on an interface
(Optional.) Configuring a static IPv4SG binding
To configure IPv6SG, perform the following tasks:
Tasks at a glance
(Required.) Enabling IPv6SG on an interface
(Optional.) Configuring a static IPv6SG binding