IP Source Guard

You can use IP Source Guard (IPSG) together with Dynamic ARP Inspection (DAI) on untrusted ports.

The RUCKUS implementation of the IPSG technology supports configuration on a port and specific VLAN memberships on a port.

When IPSG is first enabled, only DHCP packets are allowed, while all other IP traffic is blocked. IP Source Guard allows IP traffic when the system learns valid IP addresses. The system learns of a valid IP address from DHCP snooping.

When a new IP source entry binding on the port is created or deleted, an access-list with a permit filter for the IP address is added or deleted. By default, if IPSG is enabled without any IP source binding on the port, an ACL that denies all IP traffic is loaded on the port.

In this section:

  1. Configuration Notes and Feature Limitations for IP Source Guard
  2. Enabling IP Source Guard on a Port or Range of Ports
    IP Source Guard is disabled by default. You can enable IP Source Guard on DHCP snooping untrusted ports.
  3. Enabling IP Source Guard per-port-per-VLAN
    This section is to be removed for 08.0.95
    IP Source Guard can be enabled on a per-port-per-VLAN basis.
  4. Defining Static IP Source Bindings
    You can manually enter valid IP addresses in the binding database.
  5. Enabling IP Source Guard for a VLAN
    You can enable IP Source Guard (IPSG) on a switch or a router for a range of ports in a VLAN or on the entire VLAN.
  6. Enabling IP Source Guard for a LAG Port for a VLAN
    You can enable IP Source Guard for a LAG port for a VLAN.
  7. Enabling IP Source Guard on Multiple VLANs
    You can enable IP Source Guard (IPSG) on a switch or a router for a range of ports in multiple VLANs or all ports on multiple VLANs. The following task configures IPSG on a single port on multiple VLANs.
  8. Binding IP Source Guard ACLs to Ports
    You can bind IPv4 ACLs meant for IP Source Guard (IPSG) ports (SG ACL) to a port or VLAN. IP Source Guard ACLs can then be configured to allow TCP traffic and all UDP traffic. The following task binds IPSG ACL sg-acl1 to port 1/1/2.
  9. Enabling IP Source Guard on a VE
    Removing this entire section. Please confirm
    IP Source Guard can be enabled on a virtual interface.
  10. Enabling IP Source Guard on a Multi-VRF instance
    You can use IP Source Guard together with Dynamic ARP Inspection on untrusted ports.
  11. Displaying Learned IP Addresses
Parent topic: DHCPv4