D-Link DGS-6600-48TS Configuration Guide - Page 472

Volume 8-Security & Authentication / Chapter 46-IP Source Guard Chapter Overview Chapter 46 IP Source Guard Chapter Overview The following topics are included in this chapter, please go to the topic for more detailed information: • Chapter Overview • An Introduction to IP Source Guard • IP Source Guard Configuration Commands • ip verify source vlan dhcp-snooping port-security • ip source binding An Introduction to IP Source Guard IP Source Guard is a security application used on edge switches are usually directly connected to hosts. IP Source Guard provides administrators to configure pairs of MAC and IP addresses that are allowed to access networks through the switch. IP Source Guard binds together the network layer, which uses an IP address, and the Ethernet link layer, which uses a MAC address, to authenticate packets from host. The feature uses dynamic DHCP snooping and static IP source binding to match IP addresses to hosts on untrusted Layer 2 access ports. In IP Source Guard, all IP packets will be drop by default ACL rule if enable IP Source Guard. While user enables IP Source Guard will use ACL rules to authorize IP packet. After a client receives an IP address from the DHCP server, or after static IP source binding is configured by the administrator, all traffic with that IP source address is permitted from that client. Traffic from other hosts is denied. All L2 packets will be drop before IP packet with same MAC address authorized by IP source guard. The key of IP Source Guard database is MAC address and VLAN. When user configures (IP, MAC, VLAN, Port) in IP Source Guard will add a ACL permit rule. The IP packets received by switch not match the IP Source Guard database will be blocked by the ACL deny rule and the non-IP packets will be passed. If the IP Source Guard is disabled, all ACL deny and permit rules which configure by user will be removed from the hardware ACL table. Each permit and deny rule of ACL will use a double wide slice (two single wide slices) to add rules. So if ACL has no enough slices even has enough entries to enable IP source guard or config static IP source guard entry, config will be failed and prompt warning message under this situation. While user configures an IP Source guard static entry then FDB will add a dynamic entry. If user config a static FDB entry and the MAC address is conflict with IP source guard entry before this dynamic FDB entry age out, then static FDB entry will not be add and prompt message. If the dynamic FDB entry that IP source guard is age out, then static FDB entry will be add success. If user configure a static entry of IP source guard and conflict with static FDB will log and prompt error message then this configure will fail. If user config a static ARP entry confilict with the IP address of IP source guard entry, then static ARP entry will be replease the entry that IP source guard configure. If user configure a static entry of IP source guard and conflict with the IP address of static ARP will log and prompt error message then this configure will fail. If the sender of the packet is an authorized client, the packets sent from this client will be forwarded. While user configures a static entry to IP Source Guard, if the HW ACL table has no enough entry or DGS-6600 Configuration Guide 472