1-11 IP Source Guard ConfigurationWhen configuring IP Source Guard, go to these sections for information you are interested in:z IP Source Guard Overviewz Configuring a Static Binding Entryz Configuring Dynamic Binding Functionz Displaying and Maintaining IP Source Guardz IP Source Guard Configuration Examplesz Troubleshooting IP Source GuardIP Source Guard OverviewBy filtering packets on a per-port basis, IP source guard prevents illegal packets from traveling throughthe ports, so as to block illegal usages of network resources and improve the network security. Forexample, IP source guard can prevent an illegal host from pretending to be a legal user to access thenetwork. With IP source guard enabled on a port, after receiving a packet, the port looks up the keyattributes (including source IP address, source MAC address and VLAN tag) of the packet in the bindingentries of the IP source guard. If there is a match, the port forwards the packet. Otherwise, the portdiscards the packet.IP source guard filters packets based on the following types of binding entries:z IP-port binding entryz MAC-port binding entryz IP-MAC-port binding entryz IP-VLAN-port binding entryz MAC-VLAN-port binding entryz IP-MAC-VLAN-port binding entryYou can manually set static binding entries, or use DHCP snooping to provide dynamic binding entries,where the dynamic IP-MAC bindings are inherited from the DHCP client IP-MAC bindings recorded byDCHP snooping on an interface.Binding is on a per-port basis. After a binding entry is configured on a port, it is effective only to the port.Enabling IP source guard on a port is mutually exclusive with adding the port to an aggregation group.Configuring a Static Binding EntryFollow these steps to configure a static binding entry:
