IP Source Guard

ccnp-switching

How IP Source Guard uses the DHCP snooping binding database to block spoofed IP addresses, with static bindings and verification commands.

Published

Nov 19, 2017

DHCP Snooping and IP source guard are often configured together because they complement each other really really well.

Both protect the network at layer 3.
DHCP Snooping Prevents unauthorized DHCP servers from handing out IP addresses.
IP Source Guard prevents a device from using an IP address it is not entitled to. What? mmmmm! Does it sound like an ACL? That is true, it effectively behaves like an ACL, but the configuration is very different.

IP Source Binding Table

IP Source Binding Table is generated using the data from DHCP snooping database as well as any manually configured IP source bindings. This means that a host that has an entry in the DHCP snooping binding database is allowed on the network by IP source guard.

Because the IP source binding table is built from DHCP binding database, you must enable DHCP snooping on the VLANs corresponding to the interfaces you want IP source guard to protect.

Switch(config)#interface rang gigabitEthernet 0/0 - 3
Switch(config-if-range)#ip verify source

Configure a manual IP source binding

Static binding:

Switch(config)#ip source binding 0012.3456.789a vlan 1 192.168.115.14 interface gigabitEthernet 3/2

Verification

To look at the IP source guard configuration:

Switch#show ip verify source 
Interface  Filter-type  Filter-mode  IP-address       Mac-address        Vlan
---------  -----------  -----------  ---------------  -----------------  ----
Gi0/0      ip           inactive-no-snooping-vlan
Gi0/1      ip           inactive-no-snooping-vlan
Gi0/2      ip           inactive-no-snooping-vlan
Gi0/3      ip           inactive-no-snooping-vlan

The output would be very messy, so we can alternatively filter by VLAN exclusion.

Switch#show ip verify source | e vlan

We do not need to worry about our DHCP server traffic getting blocked by IP source guard. IP source guard is smart enough to disable itself on the trusted ports.

To view IP source binding table:

Switch#show ip source binding 
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:12:34:56:78:9A   192.168.115.14   infinite    static          1     GigabitEthernet3/2
Total number of bindings: 1

Alert

You cannot configure IP source guard on a layer 3 routed interface.