Feedback
Table Of Contents
IP Source Guard Interaction with VLAN-Based Features
Layer 2 and Layer 3 Port Conversion
IP Source Guard and Voice VLAN
Configuring IP Source Guard on the Switch
Displaying IP Source Guard Information
Displaying IP Source Binding Information
Configuring IP Source Guard
This chapter describes how to configure IP Source Guard in Cisco IOS Software Release 12.2SX. Release 12.2(33)SXH and later releases support IP Source Guard.
This chapter consists of these sections:
•
Configuring IP Source Guard on the Switch
•
•
Note
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/122sx/cmdref/index.htm
Overview of IP Source Guard
IP Source Guard provides source IP address filtering on a Layer 2 port to prevent a malicious host from impersonating a legitimate host by assuming the legitimate host's IP address. The feature uses dynamic DHCP snooping and static IP source binding to match IP addresses to hosts on untrusted Layer 2 access ports.
Initially, all IP traffic on the protected port is blocked except for DHCP packets. After a client receives an IP address from the DHCP server, or after static IP source binding is configured by the administrator, all traffic with that IP source address is permitted from that client. Traffic from other hosts is denied. This filtering limits a host's ability to attack the network by claiming a neighbor host's IP address. IP Source Guard is a port-based feature that automatically creates an implicit port access control list (PACL).
IP Source Guard Interaction with VLAN-Based Features
Use the access-group mode command to specify how IP Source Guard interacts with VLAN-based features (such as VACL and Cisco IOS ACL and RACL).
In prefer port mode, if IP Source Guard is configured on an interface, IP Source Guard overrides other VLAN-based features. If IP Source Guard is not configured on the interface, other VLAN-based features are merged in the ingress direction and applied on the interface.
In merge mode, IP Source Guard and VLAN-based features are merged in the ingress direction and applied on the interface. This is the default access-group mode.
Channel Ports
IP Source Guard is supported on the main Layer 2 channel interface but not on the port members. When IP Source Guard is applied on the main Layer 2 channel interface, it is applied to all the member ports in the channel.
Trunk Ports
IP Source Guard is not supported on trunk ports.
Layer 2 and Layer 3 Port Conversion
When an IP Source Guard policy is applied to a Layer 2 port, and then you change that port to be a Layer 3 port, the IP Source Guard policy no longer functions but is still present in the configuration. When the port is changed back to a Layer 2 port, IP Source Guard policy becomes effective again.
IP Source Guard and Voice VLAN
IP Source Guard is supported on a Layer 2 port that belongs to a voice VLAN. To configure the voice VLAN for the Layer 2 port, use the switchport voice vlan command. For IP Source Guard to be active on the voice VLAN, DHCP snooping must be enabled on the voice VLAN. In merge mode, the IP Source Guard feature is merged with VACL and Cisco IOS ACL configured on the access VLAN.
IP Source Guard Restrictions
Because the IP Source Guard feature is supported only in hardware, IP Source Guard is not applied if there are insufficient hardware resources available. These hardware resources are shared by various other ACL features that are configured on the system. The following restrictions apply to IP Source Guard:
•
•
•
•
•
Configuring IP Source Guard on the Switch
To enable IP Source Guard, perform this task:
Note
Static IP source binding can only be configured on switch port.The no keyword deletes the corresponding IP source binding entry. This command requires an exact match of all the required parameters in order for the deletion to be successful.
This example shows how to enable per-Layer 2 port IP Source Guard on VLANs 10 through 20:
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# ip dhcp snoopingRouter(config)# ip dhcp snooping vlan 10 20Router(config)# interface fa6/1Router(config-if)# switchport mode accessRouter(config-if)# switchport access vlan 10Router(config-if)# no ip dhcp snooping trustRouter(config-if)# ip verify source vlan dhcp-snoopingRouter(config-if)# endRouter# show ip verify source interface f6/1Interface Filter-type Filter-mode IP-address Mac-address Vlan--------- ----------- ----------- --------------- ----------------- ----------Fa6/1 ip active 10.0.0.1 10Fa6/1 ip active deny-all 11-20Router#The output shows that there is one valid DHCP binding to VLAN 10.
This example shows how to configure an interface to use prefer port mode:
Router# configure terminalRouter(config)# interface gigabitEthernet 6/1Router(config-if)# access-group mode prefer portThis example shows how to configure an interface to use merge mode:
Router# configure terminalRouter(config)# interface gigabitEthernet 6/1Router(config-if)# access-group mode mergeDisplaying IP Source Guard Information
To display IP Source Guard PACL information for all interfaces on a switch, perform this task:
Router# show ip verify source [interface interface-name]Displays IP Source Guard PACL information for all interfaces on a switch or for a specified interface.
This example shows that DHCP snooping is enabled on VLAN 10 through 20, interface fa6/1 is configured for IP filtering, and there is an existing IP address binding 10.0.01 on VLAN 10:
Router# show ip verify source interface fa6/1Interface Filter-type Filter-mode IP-address Mac-address Vlan--------- ----------- ----------- --------------- -------------- ---------fa6/1 ip active 10.0.0.1 10fa6/1 ip active deny-all 11-20
Note
This example shows the displayed PACL information for a trusted port:
Interface Filter-type Filter-mode IP-address Mac-address Vlan--------- ----------- ----------- --------------- -------------- ---------fa6/2 ip inactive-trust-portThis example shows the displayed PACL information for a port in a VLAN not configured for DHCP snooping:
Interface Filter-type Filter-mode IP-address Mac-address Vlan--------- ----------- ----------- --------------- -------------- ---------fa6/3 ip inactive-no-snooping-vlanThis example shows the displayed PACL information for a port with multiple bindings configured for an IP/MAC filtering:
Interface Filter-type Filter-mode IP-address Mac-address Vlan--------- ----------- ----------- --------------- -------------- ---------fa6/4 ip active 10.0.0.2 aaaa.bbbb.cccc 10fa6/4 ip active 11.0.0.1 aaaa.bbbb.cccd 11fa6/4 ip active deny-all deny-all 12-20This example shows the displayed PACL information for a port configured for IP/MAC filtering but not for port security:
Interface Filter-type Filter-mode IP-address Mac-address Vlan--------- ----------- ----------- --------------- -------------- ---------fa6/5 ip active 10.0.0.3 permit-all 10fa6/5 ip active deny-all permit-all 11-20
Note
This example shows an error message when you enter the show ip verify source command on a port that does not have an IP source filter mode configured:
Router# show ip verify source interface fa6/6IP Source Guard is not configured on the interface fa6/6.This example shows how to display all interfaces on the switch that have IP Source Guard enabled:
Router# show ip verify sourceInterface Filter-type Filter-mode IP-address Mac-address Vlan--------- ----------- ----------- --------------- -------------- ---------fa6/1 ip active 10.0.0.1 10fa6/1 ip active deny-all 11-20fa6/2 ip inactive-trust-portfa6/3 ip inactive-no-snooping-vlanfa6/4 ip active 10.0.0.2 aaaa.bbbb.cccc 10fa6/4 ip active 11.0.0.1 aaaa.bbbb.cccd 11fa6/4 ip active deny-all deny-all 12-20fa6/5 ip active 10.0.0.3 permit-all 10fa6/5 ip active deny-all permit-all 11-20Displaying IP Source Binding Information
To display all IP source bindings configured on all interfaces on a switch, perform this task:
This example shows how to display all IP source bindings configured on all interfaces on the switch.
Router# show ip source bindingMacAddress IpAddress Lease(sec) Type VLAN Interface------------------ --------------- ---------- ------------- ---- --------------------00:02:B3:3F:3B:99 55.5.5.2 6522 dhcp-snooping 10 FastEthernet6/1000:00:00:0A:00:0B 11.0.0.1 infinite static 10 FastEthernet6/10Router#Table 47-1 describes the fields in the show ip source binding command output.
