Home » Dell Manuals » Hubs & Switches » Dell PowerConnect 7048P » Manual Viewer

Dell PowerConnect 7048P User Manual - Page 785

What Is IP Source Guard?, IPSG and Port Security

View all Dell PowerConnect 7048P manuals

Add to My Manuals
Save this manual to your list of manuals

Page 785 highlights

What Is IP Source Guard? IPSG is a security feature that filters IP packets based on source ID. This feature helps protect the network from attacks that use IP address spoofing to compromise or overwhelm the network. The source ID may be either the source IP address or a {source IP address, source MAC address} pair. You can configure: • Whether enforcement includes the source MAC address • Static authorized source IDs The DHCP snooping bindings database and static IPSG entries identify authorized source IDs. IPSG can be enabled on physical and LAG ports. If you enable IPSG on a port where DHCP snooping is disabled or where DHCP snooping is enabled but the port is trusted, all IP traffic received on that port is dropped depending on the admin-configured IPSG entries. IPSG and Port Security IPSG interacts with port security, also known as port MAC locking, (see "What is Port Security?" on page 513) to enforce the source MAC address. Port security controls source MAC address learning in the layer 2 forwarding database (MAC address table). When a frame is received with a previously unlearned source MAC address, port security queries the IPSG feature to determine whether the MAC address belongs to a valid binding. If IPSG is disabled on the ingress port, IPSG replies that the MAC is valid. If IPSG is enabled on the ingress port, IPSG checks the bindings database. If the MAC address is in the bindings database and the binding matches the VLAN the frame was received on, IPSG replies that the MAC is valid. If the MAC is not in the bindings database, IPSG informs port security that the frame is a security violation. In the case of an IPSG violation, port security takes whatever action it normally takes upon receipt of an unauthorized frame. Port security limits the number of MAC addresses to a configured maximum. If the limit n is less than the number of stations m in the bindings database, port security allows only n stations to use the port. If n > m, port security allows only the stations in the bindings database. For information about configuring the Port Security feature, see "Configuring 802.1X and Port-Based Security" on page 505. Snooping and Inspecting Traffic 785

Section	Page
Introduction	49
About This Document	49
Audience	49
Document Conventions	50
Additional Documentation	50
Switch Features	51
System Management Features	52
Multiple Management Options	52
System Time Management	52
Log Messages	52
Integrated DHCP Server	53
Management of Basic Network Information	53
IPv6 Management Features	53
Dual Software Images	53
File Management	54
Switch Database Management Templates	54
Automatic Installation of Firmware and Configuration	54
sFlow	55
SNMP Alarms and Trap Logs	55
CDP Interoperability through ISDP	55
Remote Monitoring (RMON)	55
Stacking Features	56
High Port Count	56
Single IP Management	56
Automatic Firmware Upgrade for New Stack Members	56
Stacking Compatibility with the PowerConnect M6348	56
Master Failover with Transparent Transition	57
Nonstop Forwarding on the Stack	57
Hot Add/Delete and Firmware Synchronization	57
Security Features	57
Configurable Access and Authentication Profiles	57
Password-Protected Management Access	58
Strong Password Enforcement	58
TACACS+ Client	58
RADIUS Support	58
SSH/SSL	59
Inbound Telnet Control	59
Denial of Service	59
Captive Portal	59
Dot1x Authentication (IEEE 802.1X)	60
MAC-Based 802.1X Authentication	60
Dot1x Monitor Mode	60
MAC-Based Port Security	60
Access Control Lists (ACL)	61
Time-Based ACLs	61
IP Source Guard (IPSG)	61
DHCP Snooping	62
Dynamic ARP Inspection	62
Protected Ports (Private VLAN Edge)	62
Green Technology Features	63
Energy Detect Mode	63
Energy Efficient Ethernet	63
Power Utilization Reporting	63
Power over Ethernet (PoE) Plus Features	63
Power Over Ethernet (PoE) Plus Configuration	63
PoE Plus Support	64
Switching Features	64
Flow Control Support (IEEE 802.3x)	64
Head of Line Blocking Prevention	64
Jumbo Frames Support	64
Auto-MDI/MDIX Support	64
VLAN-Aware MAC-based Switching	65
Back Pressure Support	65
Auto Negotiation	65
Broadcast Storm Control	65
Port Mirroring	66
Static and Dynamic MAC Address Tables	66
Link Layer Discovery Protocol (LLDP)	66
Link Layer Discovery Protocol (LLDP) for Media Endpoint Devices	66
Connectivity Fault Management (IEEE 802.1ag)	67
Cisco Protocol Filtering	67
DHCP Layer 2 Relay	67
Virtual Local Area Network Supported Features	68
VLAN Support	68
Port-Based VLANs	68
IP Subnet-based VLAN	68
MAC-based VLAN	68
IEEE 802.1v Protocol-Based VLANs	68
GARP and GVRP Support	69
Voice VLAN	69
Guest VLAN	69
Double VLANs	69
Spanning Tree Protocol Features	70
Spanning Tree Protocol (STP)	70
Spanning Tree Port Settings	70
Rapid Spanning Tree	70
Multiple Spanning Tree	70
Bridge Protocol Data Unit (BPDU) Guard	71
BPDU Filtering	71
Link Aggregation Features	71
Link Aggregation	71
Link Aggregate Control Protocol (LACP)	71
Routing Features	72
Address Resolution Protocol (ARP) Table Management	72
VLAN Routing	72
IP Configuration	72
Open Shortest Path First (OSPF)	72
BOOTP/DHCP Relay Agent	73
IP Helper and UDP Relay	73
Routing Information Protocol	73
Router Discovery	73
Routing Table	73
Virtual Router Redundancy Protocol (VRRP)	74
Tunnel and Loopback Interfaces	74
IPv6 Routing Features	74
IPv6 Configuration	74
IPv6 Routes	75
OSPFv3	75
DHCPv6	75
Quality of Service (QoS) Features	76
Differentiated Services (DiffServ)	76
Class Of Service (CoS)	76
Auto Voice over IP (VoIP)	76
Internet Small Computer System Interface (iSCSI) Optimization	77
Layer 2 Multicast Features	77
MAC Multicast Support	77
IGMP Snooping	77
IGMP Snooping Querier	78
MLD Snooping	78
Multicast VLAN Registration	78
Layer 3 Multicast Features	78
Distance Vector Multicast Routing Protocol	78
Internet Group Management Protocol	79
IGMP Proxy	79
Protocol Independent Multicast—Dense Mode	79
Protocol Independent Multicast—Sparse Mode	79
Protocol Independent Multicast—Source Specific Multicast	79
Protocol Independent Multicast IPv6 Support	79
MLD/MLDv2 (RFC2710/RFC3810)	80
Hardware Overview	81
PowerConnect 7000 Series Front Panel	81
Switch Ports	84
Console Port	85
Out-of-Band Management Port	85
USB Port	85
Reset Button	86
Port and System LEDs	86
Stack Master LED and Stack Number Display	86
PowerConnect 7000 Series Back Panel	87
Expansion Slots for Plug-in Modules	88
Power Supplies	89
Ventilation System	90
Locator LED	90
LED Definitions	91
Port LEDs	91
Module LEDs	93
System LEDs	95
Using Dell OpenManage Switch Administrator	97
About Dell OpenManage Switch Administrator	97
Starting the Application	98
Understanding the Interface	99
Defining Fields	101
Understanding the Device View	102
Using the Device View Port Features	102
Using the Device View Switch Locator Feature	102
Using the Command-Line Interface	103
Accessing the Switch Through the CLI	103
Console Connection	103
Telnet Connection	104
Understanding Command Modes	105
Entering CLI Commands	107
Using the Question Mark to Get Help	107
Using Command Completion	108
Entering Abbreviated Commands	108
Negating Commands	108
Understanding Error Messages	109
Recalling Commands from the History Buffer	109
Default Settings	111
Setting the IP Address and Other Basic Network Information	115
IP Address and Network Information Overview	115
What Is the Basic Network Information?	115
Why Is Basic Network Information Needed?	116
How Is Basic Network Information Configured?	117
What Is Out-of-Band Management and In-Band Management?	117
Default Network Information	119
Configuring Basic Network Information (Web)	120
Out-of-Band Interface	120
IP Interface Configuration (Default VLAN IP Address)	121
Route Entry Configuration (Switch Default Gateway)	122
Domain Name Server	124
Default Domain Name	125
Host Name Mapping	126
Dynamic Host Name Mapping	127
Configuring Basic Network Information (CLI)	128
Enabling the DHCP Client on the OOB Port	128
Enabling the DHCP Client on the Default VLAN	128
Managing DHCP Leases	129
Configuring Static Network Information on the OOB Port	130
Configuring Static Network Information on the Default VLAN	130
Configuring and Viewing Additional Network Information	131
Basic Network Information Configuration Example	132
Managing a Switch Stack	135
Stacking Overview	135
PowerConnect 7000 Series and M6348 Stacking Compatibility	137
How is the Management Unit Selected?	137
Adding a Switch to the Stack	138
Removing a Switch from the Stack	139
How is the Firmware Updated on the Stack?	140
What is Stacking Standby?	140
What is Nonstop Forwarding?	140
Switch Stack MAC Addressing and Stack Design Considerations	143
NSF Network Design Considerations	144
Why is Stacking Needed?	144
Default Stacking Values	145
Managing and Monitoring the Stack (Web)	146
Unit Configuration	146
Stack Summary	148
Stack Firmware Synchronization	149
Supported Switches	150
Stack Port Summary	151
Stack Port Counters	152
Stack Port Diagnostics	152
NSF Summary	153
Checkpoint Statistics	154
Managing the Stack (CLI)	155
Configuring Stack Member and NSF Settings	155
Viewing and Clearing Stacking and NSF Information	156
Stacking and NSF Usage Scenarios	157
Basic Failover	158
Preconfiguring a Stack Member	160
NSF in the Data Center	162
NSF and VoIP	163
NSF and DHCP Snooping	164
NSF and the Storage Access Network	165
NSF and Routed Access	167
Controlling Management Access	169
Management Access Control Overview	169
What Are the Recommendations for Management Security?	171
What Is an Authentication Profile?	171
How Does TACACS+ Control Management Access?	172
How Does RADIUS Control Management Access?	174
What are RADIUS Server Groups?	176
How Does the Switch Determine Which RADIUS Server to Contact?	176
What Other Features Use Authentication?	178
Default Management Security Values	178
Controlling Management Access (Web)	180
Access Profile	180
Authentication Profiles	184
Select Authentication	187
Password Management	188
Last Password Set Result	190
User Login Configuration	191
Local User Database	192
Line Password	194
Enable Password	194
TACACS+ Settings	195
RADIUS Global Configuration	197
RADIUS Server Configuration	198
RADIUS Accounting Server Configuration	200
RADIUS Accounting Server Statistics	202
RADIUS Server Statistics	203
Authorization Network RADIUS	204
Telnet Server	205
Denial of Service	206
Secure HTTP Configuration	207
Secure Shell Configuration	210
Secure Public Key Configuration	211
Controlling Management Access (CLI)	213
Configuring a Management Access List	213
Adding Users to the Local Database	215
Configuring and Applying Authentication Profiles	216
Managing Passwords	217
Configuring RADIUS Server Information	219
Configuring TACACS+ Server Information	221
Configuring Telnet and SSH Access	222
Configuring HTTP and HTTPS Access	223
Configuring DoS Information	225
Management Access Configuration Examples	227
Configuring a Management Access List	227
Configuring the Primary and Secondary RADIUS Servers	228
Configuring an Authentication Profile	230
Configuring Password Lockout	231
Monitoring and Logging System Information	235
System Monitoring Overview	235
What System Information Is Monitored?	235
Why Is System Information Needed?	236
Where Are Log Messages Sent?	236
What Are the Severity Levels?	237
What Are the System Startup and Operation Logs?	237
What Is the Log Message Format?	238
What Factors Should Be Considered When Configuring Logging?	239
Default Log Settings	239
Monitoring System Information and Configuring Logging (Web)	240
Device Information	240
System Health	242
System Resources	243
Unit Power Usage History	244
Integrated Cable Test for Copper Cables	245
Optical Transceiver Diagnostics	246
Log Global Settings	248
RAM Log	249
Log File	250
Remote Log Server	250
Email Alert Global Configuration	253
Email Alert Mail Server Configuration	254
Email Alert Subject Configuration	256
Email Alert To Address Configuration	257
Email Alert Statistics	258
Monitoring System Information and Configuring Logging (CLI)	259
Viewing System Information and Enabling the Locator LED	259
Running Cable Diagnostics	259
Configuring Local Logging	260
Configuring Remote Logging	262
Configuring Mail Server Settings	263
Configuring Email Alerts for Log Messages	264
Logging Configuration Examples	266
Configuring Local and Remote Logging	266
Configuring Email Alerting	268
Managing General System Settings	271
System Settings Overview	271
Why Does System Information Need to Be Configured?	272
What Are SDM Templates?	273
Why is the System Time Needed?	274
How Does SNTP Work?	274
What Configuration Is Required for Plug-In Modules?	275
What Are the Key PoE Plus Features for the PC7024P and PC7048P?	275
Default General System Information	277
Configuring General System Settings (Web)	278
System Information	278
CLI Banner	281
SDM Template Preference	282
Clock	283
SNTP Global Settings	284
SNTP Authentication	285
SNTP Server	287
Summer Time Configuration	291
Time Zone Configuration	292
Card Configuration	293
Slot Summary	294
Supported Cards	295
Power Over Ethernet Global Configuration (7024P/7048P Only)	296
Power Over Ethernet Interface Configuration (7024P/7048P Only)	297
Configuring System Settings (CLI)	299
Configuring System Information	299
Configuring the Banner	300
Managing the SDM Template	301
Configuring SNTP Authentication and an SNTP Server	301
Setting the System Time and Date Manually	303
Configuring the Expansion Slots	304
Configuring PoE Settings (7024P/7048P Only)	305
General System Settings Configuration Examples	308
Configuring System and Banner Information	308
Configuring SNTP	310
Configuring the Time Manually	312
Configuring SNMP	313
SNMP Overview	313
What Is SNMP?	313
What Are SNMP Traps?	314
Why Is SNMP Needed?	315
Default SNMP Values	315
Configuring SNMP (Web)	317
SNMP Global Parameters	317
SNMP View Settings	318
Access Control Group	320
SNMPv3 User Security Model (USM)	321
Communities	324
Notification Filter	327
Notification Recipients	328
Trap Flags	331
OSPFv2 Trap Flags	332
OSPFv3 Trap Flags	333
Trap Log	334
Configuring SNMP (CLI)	335
Configuring the SNMPv3 Engine ID	335
Configuring SNMP Views, Groups, and Users	336
Configuring Communities	339
Configuring SNMP Notifications (Traps and Informs)	341
SNMP Configuration Examples	344
Configuring SNMPv1 and SNMPv2	344
Configuring SNMPv3	345
Managing Images and Files	349
Image and File Management Overview	349
What Files Can Be Managed?	349
Why Is File Management Needed?	351
What Methods Are Supported for File Management?	353
What Factors Should Be Considered When Managing Files?	353
How Is the Running Configuration Saved?	355
Managing Images and Files (Web)	356
File System	356
Active Images	357
USB Flash Drive	358
File Download	359
File Upload	361
Copy Files	363
Managing Images and Files (CLI)	364
Downloading and Activating a New Image (TFTP)	364
Managing Files in Internal Flash	365
Managing Files on a USB Flash Device	366
Uploading a Configuration File (SCP)	366
Managing Configuration Scripts (SFTP)	367
File and Image Management Configuration Examples	368
Upgrading the Firmware	368
Managing Configuration Scripts	371
Managing Files by Using the USB Flash Drive	373
Automatically Updating the Image and Configuration	375
Auto Configuration Overview	375
What Is USB Auto Configuration?	376
What Files Does USB Auto Configuration Use?	376
How Does USB Auto Configuration Use the Files on the USB Device?	377
What Is the Setup File Format?	378
What Is the DHCP Auto Configuration Process?	379
Monitoring and Completing the DHCP Auto Configuration Process	383
What Are the Dependencies for DHCP Auto Configuration?	384
Default Auto Configuration Values	385
Managing Auto Configuration (Web)	386
Auto-Install Configuration	386
Managing Auto Configuration (CLI)	387
Managing Auto Configuration	387
Auto Configuration Example	388
Enabling USB Auto Configuration and Auto Image Download	388
Enabling DHCP Auto Configuration and Auto Image Download	390
Monitoring Switch Traffic	391
Traffic Monitoring Overview	391
What is sFlow Technology?	391
What is RMON?	394
What is Port Mirroring?	395
Why is Traffic Monitoring Needed?	396
Default Traffic Monitoring Values	396
Monitoring Switch Traffic (Web)	397
sFlow Agent Summary	397
sFlow Receiver Configuration	398
sFlow Sampler Configuration	399
sFlow Poll Configuration	400
Interface Statistics	401
Etherlike Statistics	402
GVRP Statistics	403
EAP Statistics	404
Utilization Summary	405
Counter Summary	406
Switchport Statistics	407
RMON Statistics	408
RMON History Control Statistics	409
RMON History Table	411
RMON Event Control	412
RMON Event Log	414
RMON Alarms	415
Port Statistics	417
LAG Statistics	418
Port Mirroring	419
Monitoring Switch Traffic (CLI)	421
Configuring sFlow	421
Configuring RMON	423
Viewing Statistics	425
Configuring Port Mirroring	426
Traffic Monitoring Configuration Examples	427
Configuring sFlow	427
Configuring RMON	429
Configuring iSCSI Optimization	431
iSCSI Optimization Overview	431
When Should iSCSI Optimization Be Enabled?	432
How Does the Switch Detect iSCSI Traffic Flows?	432
How Is Quality of Service Applied to iSCSI Traffic Flows?	432
What Information Does the Switch Track in iSCSI Traffic Flows?	433
How Does iSCSI Optimization Interact With Dell EqualLogic Arrays?	433
What Occurs When iSCSI is Enabled or Disabled?	434
Default iSCSI Optimization Values	435
Configuring iSCSI Optimization (Web)	436
iSCSI Global Configuration	436
iSCSI Targets Table	437
iSCSI Sessions Table	438
iSCSI Sessions Detailed	439
Configuring iSCSI Optimization (CLI)	440
iSCSI Optimization Configuration Examples	442
Configuring iSCSI Optimization Between Servers and a Disk Array	442
Configuring a Captive Portal	445
Captive Portal Overview	445
What Does a Captive Portal Do?	445
Is the Captive Portal Feature Dependent on Any Other Feature?	446
What Factors Should Be Considered When Designing and Configuring a Captive Portal?	447
How Does Captive Portal Work?	448
What Captive Portal Pages Can Be Customized?	449
Default Captive Portal Behavior and Settings	450
Configuring the Captive Portal (Web)	452
Captive Portal Global Configuration	452
Captive Portal Configuration	453
Local User	458
User Group	462
Interface Association	464
Captive Portal Global Status	465
Captive Portal Activation and Activity Status	466
Interface Activation Status	467
Interface Capability Status	468
Client Summary	469
Client Detail	470
Captive Portal Interface Client Status	471
Captive Portal Client Status	472
Configuring a Captive Portal (CLI)	473
Configuring Global Captive Portal Settings	473
Creating and Configuring a Captive Portal	474
Configuring Captive Portal Groups and Users	477
Managing Captive Portal Clients	478
Captive Portal Configuration Example	479
Configuration Overview	480
Detailed Configuration Procedures	481
Configuring Port Characteristics	483
Port Overview	483
What Physical Port Characteristics Can Be Configured?	483
What is Link Dependency?	484
What Interface Types are Supported?	486
What is Interface Configuration Mode?	486

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234

Match case Limit results 1 per page

Snooping and Inspecting Traffic

785

What Is IP Source Guard?

IPSG is a security feature that filters IP packets based on source ID. This

feature helps protect the network from attacks that use IP address spoofing to

compromise or overwhelm the network.

The source ID may be either the source IP address or a {source IP address,

source MAC address} pair. You can configure:

•

Whether enforcement includes the source MAC address

•

Static authorized source IDs

The DHCP snooping bindings database and static IPSG entries identify

authorized source IDs. IPSG can be enabled on physical and LAG ports.

If you enable IPSG on a port where DHCP snooping is disabled or where

DHCP snooping is enabled but the port is trusted, all IP traffic received on

that port is dropped depending on the admin-configured IPSG entries.

IPSG and Port Security

IPSG interacts with port security, also known as port MAC locking, (see

"What is Port Security?" on page 513) to enforce the source MAC address.

Port security controls source MAC address learning in the layer 2 forwarding

database (MAC address table). When a frame is received with a previously

unlearned source MAC address, port security queries the IPSG feature to

determine whether the MAC address belongs to a valid binding.

If IPSG is disabled on the ingress port, IPSG replies that the MAC is valid. If

IPSG is enabled on the ingress port, IPSG checks the bindings database. If

the MAC address is in the bindings database and the binding matches the

VLAN the frame was received on, IPSG replies that the MAC is valid. If the

MAC is not in the bindings database, IPSG informs port security that the

frame is a security violation.

In the case of an IPSG violation, port security takes whatever action it

normally takes upon receipt of an unauthorized frame. Port security limits the

number of MAC addresses to a configured maximum. If the limit

is less

than the number of stations

in the bindings database, port security allows

only

stations to use the port. If

n > m

, port security allows only the stations

in the bindings database. For information about configuring the Port Security

feature, see "Configuring 802.1X and Port-Based Security" on page 505.