159
7.
Security
7.1.
IP Source Guard
IP Source Guard is a security feature that restricts IP traffic on untrusted Layer 2 ports by filtering
traffic based on the DHCP snooping binding database or manually configured IP source bindings.
This feature helps prevent IP spoofing attacks when a host tries to spoof and use the IP address
of another host. Any IP traffic coming into the interface with a source IP address other than that
assigned (via DHCP or static configuration) will be filtered out on the untrusted Layer 2 ports.
The IP Source Guard feature is enabled in combination with the DHCP snooping feature on
untrusted Layer 2 interfaces. It builds and maintains an IP source binding table that is learned by
DHCP snooping or manually configured (static IP source bindings). An entry in the IP source
binding table contains the IP address and the associated MAC and VLAN numbers. The IP
Source Guard is supported on Layer 2 ports only, including access and trunk ports.
The IP Source Guard features include below functions:
1.
DHCP Snooping.
2.
DHCP Binding table.
3.
ARP Inspection.
4.
Blacklist Filter. (arp-inspection mac-filter table)
7.1.1.
DHCP Snooping
7.1.1.1.
Introduction
DHCP snooping is a DHCP security feature that provides network security by filtering untrusted
DHCP messages and by building and maintaining a DHCP snooping binding database, which is
also referred to as a DHCP snooping binding table.
DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. You can use
DHCP snooping to differentiate between untrusted interfaces connected to the end user and
trusted interfaces connected to the DHCP server or another switch.
The DHCP snooping binding database contains the MAC address, the IP address, the lease time,
the binding type, the VLAN number, and the interface information that corresponds to the local
untrusted interfaces of a switch.
When a switch receives a packet on an untrusted interface and the interface belongs to a VLAN
in which DHCP snooping is enabled, the switch compares the source MAC address and the
DHCP client hardware address. If addresses match (the default), the switch forwards the packet.
If the addresses do not match, the switch drops the packet.
The switch drops a DHCP packet when one of these situations occurs:
✓
A packet from a DHCP server, such as a DHCPOFFER, DHCPACK, DHCPNAK, or
DHCPLEASEQUERY packet, is received from the untrusted port.
✓
A packet is received on an untrusted interface, and the source MAC address and the
DHCP client hardware address do not match any of the current bindings.
