Users Guide

Snooping and Inspecting Traffic 1037
Configuring IP Source Guard
Use the following commands to configure IPSG settings on the switch.
clear ip dhcp snooping
bindings
Clear the DHCP snooping bindings for an interface.
Command Purpose
configure Enter global configuration mode.
interface interface Enter interface configuration mode for the specified port
or LAG. The interface variable includes the interface type
and number, for example tengigabitethernet 1/0/3. For a
LAG, the interface type is port-channel.
A range of ports can be specified using the interface range
command. For example, interface range
tengigabitethernet 1/0/8-12 configures interfaces 8, 9, 10,
11, and 12.
ip verify source [port-
security]
and
ipv6 verify source [port-
security]
Enable IPSG on the port or LAG to prevent packet
forwarding if the source IP address in the packet is not in
the DHCP snooping binding database. Use the optional
port-security keyword to also prevent packet forwarding if
the sender MAC address is not in forwarding database
table or the DHCP snooping binding database.
NOTE: To enforce filtering based on the source MAC
address, port security must also be enabled on the interface
by using the port security command in Interface
Configuration mode.
exit Exit to Global Config mode.
ip verify binding
mac_addr vlan vlan_id
ipaddr interface interface
and
ipv6 verify binding
mac_addr vlan vlan_id
ipaddr interface interface
Configure a static binding for IPSG.
exit Exit to Privileged Exec mode.
Command Purpose