The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter describes how to configure IP Source Guard on the Cisco Nexus 5000 Series switch.
This chapter includes the following sections:
IP Source Guard is a per-interface traffic filter that permits IP traffic only when the IP address and MAC address of each packet matches one of two sources of IP and MAC address bindings:
Entries in the Dynamic Host Configuration Protocol (DHCP) snooping binding table.
Static IP source entries that you configure.
Filtering on trusted IP and MAC address bindings helps prevent spoofing attacks, in which an attacker uses the IP address of a valid host to gain unauthorized network access. To circumvent IP Source Guard, an attacker would have to spoof both the IP address and the MAC address of a valid host.
You can enable IP Source Guard on Layer 2 interfaces that are not trusted by DHCP snooping. IP Source Guard supports interfaces that are configured to operate in access mode and trunk mode. When you initially enable IP Source Guard, all inbound IP traffic on the interface is blocked except for the following:
DHCP packets, which DHCP snooping inspects and then forwards or drops, depending upon the results of inspecting the packet.
IP traffic from static IP source entries that you have configured in the Cisco NX-OS device.
The device permits the IP traffic when DHCP snooping adds a binding table entry for the IP address and MAC address of an IP packet or when you have configured a static IP source entry.
The device drops IP packets when the IP address and MAC address of the packet do not have a binding table entry or a static IP source entry. For example, assume that :
MacAddress IpAddress LeaseSec Type VLAN Interface ---------- ---------- --------- ------ ------- --------- 00:02:B3:3F:3B:99 10.5.5.2 6943 dhcp-snooping 10 Ethernet2/3
If the device receives an IP packet with an IP address of 10.5.5.2, IP Source Guard forwards the packet only if the MAC address of the packet is 00:02:B3:3F:3B:99.
This table shows the licensing requirements for IP Source Guard.
Product |
License Requirement |
---|---|
Cisco NX-OS |
IP Source Guard requires no license. Any feature not included in a license package is bundled with the Cisco NX-OS system images and is provided at no extra charge to you. |
IP Source Guard has the following configuration guidelines and limitations:
IP Source Guard limits IP traffic on an interface to only those sources that have an IP-MAC address binding table entry or static IP source entry. When you first enable IP Source Guard on an interface, you may experience disruption in IP traffic until the hosts on the interface receive a new IP address from a DHCP server.
IP Source Guard is dependent upon DHCP snooping to build and maintain the IP-MAC address binding table or upon manual maintenance of static IP source entries.
Parameters |
Default |
---|---|
IP Source Guard |
Disabled on each interface. |
IP source entries |
None. No static or default IP source entries exist by default. |
You can enable or disable IP Source Guard on a Layer 2 interface. By default, IP Source Guard is disabled on all interfaces.
Ensure that the DHCP feature is enabled.
2.
interface ethernet slot/port
3.
[no] ip verify source dhcp-snooping-vlan
4.
(Optional) show running-config dhcp
5.
(Optional) copy running-config startup-config
Command or Action | Purpose | |
---|---|---|
Step 1 | configure terminal Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 | interface ethernet slot/port Example: switch(config)# interface ethernet 2/3 switch(config-if)# |
Enters interface configuration mode for the specified interface. |
Step 3 | [no] ip verify source dhcp-snooping-vlan Example: switch(config-if)# ip verify source dhcp-snooping vlan |
Enables IP Source Guard on the interface. The no option disables IP Source Guard on the interface. |
Step 4 | show running-config dhcp Example: switch(config-if)# show running-config dhcp |
(Optional) Displays the running configuration for DHCP snooping, including the IP Source Guard configuration. |
Step 5 | copy running-config startup-config Example: switch(config-if)# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
You can add or remove a static IP source entry on a device. By default, there are no static IP source entries on a device.
2.
[no] ip source binding IP-address MAC-address vlan vlan-ID interface ethernet slot/port
3.
(Optional) show ip dhcp snooping binding [interface ethernet slot/port]
4.
(Optional) copy running-config startup-config
Command or Action | Purpose | |
---|---|---|
Step 1 | configure terminal Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 | [no] ip source binding IP-address MAC-address vlan vlan-ID interface ethernet slot/port Example: switch(config)# ip source binding 10.5.22.17 001f.28bd.0013 vlan 100 interface ethernet 2/3 |
Creates a static IP source entry for the current interface, or if you use the no option, removes a static IP source entry. |
Step 3 | show ip dhcp snooping binding [interface ethernet slot/port] Example: switch(config)# show ip dhcp snooping binding interface ethernet 2/3 |
(Optional) Displays IP-MAC address bindings for the interface specified, including static IP source entries. Static entries appear with the term in the Type column. |
Step 4 | copy running-config startup-config Example: switch(config)# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Use the show ip verify source command to display IP-MAC address bindings.
This example shows how to create a static IP source entry and then how to enable IP Source Guard on an interface.
ip source binding 10.5.22.17 001f.28bd.0013 vlan 100 interface ethernet 2/3 interface ethernet 2/3 no shutdown ip verify source dhcp-snooping-vlan
Standards |
Title |
---|---|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
— |