204All the fields in a static IPv4 binding entry are used by IP source guard to filter packets. For informationabout how to configure a static IPv4 binding entry, see "Configuring a static IPv4 source guard bindingentry on an interface."Dynamic IPv4 binding entries can contain such information as the MAC address, IPv4 address, VLANtag, ingress interface information, and entry type (such as DHCP snooping and DHCP relay). Whichinformation in an entry is used by IP source guard to filter IPv4 packets is determined by the IPv4 sourceguard configuration on the interface:• If you bind both the source IP address and the source MAC address on the interface, the interfaceforwards a received packet only when the packet's source IP address and source MAC addressboth match a dynamic binding entry. If no match is found, the packet is dropped.• If you bind only the source IP address on the interface, the interface forwards a packet as long asthe packet's source IP address matches a dynamic binding entry. If no match is found, the packet isdropped.To implement dynamic IPv4 source guard, make sure the DHCP snooping or DHCP relay functionoperate correctly on the network.To enable the IPv4 source guard function on an interface:Step Command Remarks1. Enter system view. system-view N/A2. Enter interface view. interface interface-typeinterface-numberThese types of interfaces aresupported: Ethernet port and VLANinterface.3. Enable the IPv4 source guardfunction.ip verify source ip-address[ mac-address ]By default, the function is disabledon an interface.Configuring a static IPv4 source guard binding entry on aninterfaceStep Command Remarks1. Enter system view. system-view N/A2. Enter interface view. interface interface-typeinterface-numberThese types of interfaces are supported:Ethernet interface and VLAN interface.3. Configure a static IPv4binding entry.ip source binding ip-addressip-address [ mac-addressmac-address ] [ vlan vlan-id ]By default, no static IPv4 binding entry isconfigured on an interface.The vlan vlan-id option is supported in onlyEthernet interface view.
