Configuration Guide Configuring IP Source Guard
9 Configuring IP Source Guard
9.1 Overview
The IP Source Guard function realizes hardware-based IP packet filtering to ensure that only the users having their
information in the binding database can access networks normally, preventing users from forging IP packets.
9.2 Applications
Guarding Against IP/MAC Spoofing
Attack
In network environments, malicious users launch attacks through forging IP packets.
9.2.1 Guarding Against IP/MAC Spoofing Attack
Scenario
Check the IP packets from DHCP untrusted ports. Forged IP packets will be filtered out based on the IP or IP-MAC field.
For example, in the following figure, the IP packets sent by DHCP clients are checked.
 The Source IP Address fields of IP packets should match DHCP-assigned IP addresses.
 The Source MAC Address fields of layer-2 packets should match the MAC addresses in DHCP request packets from
clients.
Figure 9-1
S is a network access server (NAS).
A and C are user PCs.
B is a DHCP server within the control area.
Deployment
To Next Page
Loading...
Need help?
General
