1-11 IP Source Guard ConfigurationWhen configuring IP Source Guard, go to these sections for information you are interested in:z IP Source Guard Overviewz Configuring a Static Binding Entryz Configuring Dynamic Binding Functionz Displaying and Maintaining IP Source Guardz IP Source Guard Configuration Examplesz Troubleshooting IP Source GuardIP Source Guard OverviewBy filtering packets on a per-port basis, IP source guard prevents illegal packets from traveling through,thus improving the network security. After receiving a packet, the port looks up the key attributes(including IP address, MAC address and VLAN tag) of the packet in the binding entries of the IP sourceguard. If there is a match, the port forwards the packet. Otherwise, the port discards the packet.IP source guard filters packets based on the following types of binding entries:z IP-port binding entryz MAC-port binding entryz IP-MAC-port binding entryz IP-VLAN-port binding entryz MAC-VLAN-port binding entryz IP-MAC-VLAN-port binding entryYou can manually set static binding entries, or use DHCP snooping or DHCP relay to provide dynamicbinding entries. Binding is on a per-port basis. After a binding entry is configured on a port, it is effectiveonly to the port.Enabling IP source guard on a port is mutually exclusive with adding the port to an aggregation group.Configuring a Static Binding EntryFollow these steps to configure a static binding entry:To do… Use the command… RemarksEnter system view system-view —Enter interface view interface interface-typeinterface-number —
