Configuring Ip Source Guard For Static Hosts - Cisco Catalyst 4500 series Administration Manual
Hide thumbs
Also See for Catalyst 4500 series:
- Software configuration manual (2086 pages) ,
- Configuration manual (1610 pages) ,
- Command reference manual (1230 pages)
Table of Contents
Advertisement
Configuring IP Source Guard for Static Hosts
Table 53-3
Field
Type
VLAN
Interface
Configuring IP Source Guard for Static Hosts
Note
IPSG for static hosts should not be used on uplink ports.
IP source guard (IPSG) for static hosts extends the IPSG capability to non-DHCP and static
environments.
This section includes these topics:
•
•
•
About IP Source Guard for Static Hosts
The prior feature, IPSG, uses the entries created by the DHCP snooping feature to validate the hosts
connected to a switch. Any traffic received from a host without a valid DHCP binding entry is dropped.
A DHCP environment is a prerequisite for IPSG to work. The IPSG for static hosts feature removes
IPSG' dependency on DHCP. The switch creates static entries based on ARP requests or other IP packets
and uses them to maintain the list of valid hosts for a given port. In addition, you can specify the number
of hosts that would be allowed to send traffic to a given port. it is equivalent to port security at Layer 3.
Some IP hosts with multiple network interfaces may inject some invalid packets into a network interface.
Note
Those invalid packets contain the IP-to-MAC address for another network interface of that host as the
source address. It may cause IPSG for static hosts in the switch, which connects to the host, to learn the
invalid IP-to-MAC address bindings and reject the valid bindings. You should consult the vendor of the
corresponding operating system and the network device of that host to prevent it from injecting invalid
packets.
IPSG for static hosts initially learns IP-to-MAC bindings dynamically through an ACL-based snooping
method. IP-to-MAC bindings are learned from static hosts by using ARP and IP packets and are stored
using the device tracking database. Once the number of IP addresses that have been dynamically learned
or statically configured on a given port reaches a maximum limit, any packet with a new IP address is
dropped in hardware. To handle hosts that have moved or gone away for any reason, the IPSG for static
hosts feature uses the IP device tracking functionality to age out dynamically learned IP address
bindings. This feature can be used in conjunction with DHCP snooping. Multiple bindings will be
established on a port that is connected to both DHCP and static hosts (that is, bindings will be stored in
both the device tracking database as well as the DHCP snooping binding database).
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
53-24
show ip source binding Command Output (continued)
Description
Binding type; static bindings configured from CLI to dynamic binding
learned from DHCP snooping
VLAN number of the client interface
Interface that connects to the DHCP client host
About IP Source Guard for Static Hosts, page 53-24
Configuring IPSG for Static Hosts on a Layer 2 Access Port, page 53-25
Configuring IPSG for Static Hosts on a PVLAN Host Port, page 53-28
Chapter 53
Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts
OL_28731-01
Advertisement
Chapters
Table of Contents
Troubleshooting
