234
7.
Security
7.1
IP Source Guard
IP Source Guard is a security feature that restricts IP traffic on un-trusted Layer 2 ports by
filtering traffic based on the DHCP snooping binding database or manually configured IP source
bindings. This feature helps prevent IP spoofing attacks when a host tries to spoof and use the IP
address of another host. Any IP traffic coming into the interface with a source IP address other
than that assigned (via DHCP or static configuration) will be filtered out on the un-trusted Layer
2 ports.
The IP Source Guard feature is enabled in combination with the DHCP snooping feature on un-
trusted Layer 2 interfaces. It builds and maintains an IP source binding table that is learned by
DHCP snooping or manually configured (static IP source bindings). An entry in the IP source
binding table contains the IP address and the associated MAC and VLAN numbers. The IP
Source Guard is supported on Layer 2 ports only, including access and trunk ports.
The IP Source Guard features include below functions:
1.
DHCP Snooping.
2.
DHCP Binding table.
3.
ARP Inspection.
4.
Blacklist Filter. (arp-inspection mac-filter table)
7.1.1
DHCP Snooping
DHCP snooping is a DHCP security feature that provides network security by filtering un-trusted
DHCP messages and by building and maintaining a DHCP snooping binding database, which is
also referred to as a DHCP snooping binding table.
DHCP snooping acts like a firewall between un-trusted hosts and DHCP servers. You can use
DHCP snooping to differentiate between un-trusted interfaces connected to the end user and
trusted interfaces connected to the DHCP server or another switch.
The DHCP snooping binding database contains the MAC address, the IP address, the lease time,
the binding type, the VLAN number, and the interface information that corresponds to the local
un-trusted interfaces of a switch.
When a switch receives a packet on an un-trusted interface and the interface belongs to a VLAN
in which DHCP snooping is enabled, the switch compares the source MAC address and the
DHCP client hardware address. If addresses match (the default), the switch forwards the packet.
If the addresses do not match, the switch drops the packet.
The switch drops a DHCP packet when one of these situations occurs:
A packet from a DHCP server, such as a DHCPOFFER, DHCPACK, DHCPNAK, or
DHCPLEASEQUERY packet, is received from the un-trusted port.
A packet is received on an un-trusted interface, and the source MAC address and the
DHCP client hardware address do not match any of the current bindings.
Use DHCP snooping to filter unauthorized DHCP packets on the network and to build the binding
Summary of Contents for NGI-M08C4POE8-2
Page 1: ......
Page 197: ...197 Clear Clear the statistics of the valn ...
Page 298: ...298 9 2 2 Web Configurations ...
