323
# Configure the IPv4 source guard function on Ethernet 1/0/1 to filter packets based on the source IP
address.
[DeviceB] interface ethernet 1/0/1
[DeviceB-Ethernet1/0/1] ip verify source ip-address
# Configure Ethernet 1/0/1 to allow only IP packets with the source IP address of 192.168.0.2 to pass.
[DeviceB-Ethernet1/0/1] ip source binding ip-address 192.168.0.2
[DeviceB-Ethernet1/0/1] quit
Verifying the configuration
# On Device A, display information about static IPv4 source guard binding entries. The output shows that
the static IPv4 source guard binding entries are configured successfully.
[DeviceA] display ip source binding static
Total entries found: 2
MAC Address IP Address VLAN Interface Type
0001-0203-0405 192.168.0.3 N/A Eth1/0/2 Static
0001-0203-0406 192.168.0.1 N/A Eth1/0/1 Static
# On Device B, display information about static IPv4 source guard binding entries. The output shows that
the static IPv4 source guard binding entries are configured successfully.
[DeviceB] display ip source binding static
Total entries found: 2
MAC Address IP Address VLAN Interface Type
0001-0203-0406 192.168.0.1 N/A Eth1/0/2 Static
N/A 192.168.0.2 N/A Eth1/0/1 Static
Dynamic IPv4 source guard binding by DHCP snooping
configuration example
Network requirements
As shown in Figure 121, the device connects to the host (client) and the DHCP server through ports
Ethernet 1/0/1 and Ethernet 1/0/2 respectively. The host obtains an IP address from the DHCP server.
Enable DHCP snooping on the device to record the DHCP snooping entry of the host. Enable the IPv4
source guard function on the device’s port Ethernet 1/0/1 to filter packets based on the DHCP snooping
entry, allowing only packets from clients that obtain IP addresses through the DHCP server to pass.
NOTE:
For information about DHCP server configuration, see
Layer 3—IP Services Configuration Guide.
Figure 121 Network diagram
Configuration procedure
1. Configure DHCP snooping.
To Next Page
Loading...
Need help?
General