Filter
Top Products
1362 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
IP source guard
39
• The number of configured ACL rules affect the rate at which hardware resources are used
when IP Source Guard is enabled. Use the show access-list hw-usage on command to enable
hardware usage for an ACL, followed by a show access-list <access-list-id> command to
determine the hardware usage for an ACL.
Example
PowerConnect#show access-list hw-usage on
PowerConnect#show access-list 100
Extended IP access list 100 (hw usage : 2)
deny ip any any (hw usage : 1)
To provide more hardware resource for IP Source Guard addresses, modify the ACL rules so
that it uses less hardware resource.
• If you enable IP Source Guard in a network topology that has DHCP clients, you must also
enable DHCP snooping. Otherwise, all IP traffic including DHCP packets will be blocked.
• When you enable IP Source Guard in a network topology that does not have DHCP clients, you
must create an IP source binding for each client that will be allowed access to the network.
Otherwise, data packets will be blocked. Refer to “Defining static IP source bindings” on
page 1362.
• Source Guard Protection enables concurrent support with multi-device port authentication.
For details, Refer to “Enabling source guard protection” on page 1286.
• IP Source Guard is supported on a VE with or without an assigned IP address.
Enabling IP source guard on a port
You can enable IP Source Guard on DHCP snooping untrusted ports. Refer to “DHCP snooping” on
page 1349 for how to configure DHCP and DHCP untrusted ports.
By default, IP Source Guard is disabled. To enable IP Source Guard on a DHCP untrusted port, enter
the following commands.
PowerConnect(config)#interface ethernet 1/4
PowerConnect(config-if-e10000-1/4)#source-guard enable
The commands change the CLI to the interface configuration level for port 1/4 and enable IP
Source Guard on the port.
Syntax: [no] source-guard enable
Defining static IP source bindings
You can manually enter valid IP addresses in the binding database. To do so, enter a command
such as the following.
PowerConnect(config)#ip source binding 10.10.10.1 e 2/4 vlan 4
Syntax: [no] ip source binding <ip-addr> ethernet [<slotnum>/]<portnum> [vlan <vlannum>]
For <ip-addr>, enter a valid IP address.
The <slotnum> parameter is required on chassis devices.
The <portnum> parameter is a valid port number.