Cisco Nexus 5000 Series Bedienungsanleitung

Configuring IP Source Guard

This chapter describes how to configure IP Source Guard on the Cisco Nexus 5000 Series switch.

This chapter includes the following sections:

•Information About IP Source Guard, page 1

•Licensing Requirements for IP Source Guard, page 2

•Prerequisites for IP Source Guard, page 2

•Guidelines and Limitations for IP Source Guard, page 2

•Default Settings for IP Source Guard, page 2

•Configuring IP Source Guard, page 3

•Displaying IP Source Guard Bindings, page 5

•Configuration Example for IP Source Guard, page 5

•Additional References for IP Source Guard, page 5

Information About IP Source Guard

IP Source Guard is a per-interface traffic filter that permits IP traffic only when the IP address and MAC

address of each packet matches one of two sources of IP and MAC address bindings:

• Entries in the Dynamic Host Configuration Protocol (DHCP) snooping binding table.

• Static IP source entries that you configure.

Filtering on trusted IP and MAC address bindings helps prevent spoofing attacks, in which an attacker uses

the IP address of a valid host to gain unauthorized network access. To circumvent IP Source Guard, an attacker

would have to spoof both the IP address and the MAC address of a valid host.

You can enable IP Source Guard on Layer 2 interfaces that are not trusted by DHCP snooping. IP Source

Guard supports interfaces that are configured to operate in access mode and trunk mode. When you initially

enable IP Source Guard, all inbound IP traffic on the interface is blocked except for the following:

• DHCP packets, which DHCP snooping inspects and then forwards or drops, depending upon the results

of inspecting the packet.

Cisco Nexus 5000 Series NX-OS Security Configuration Guide, Release 5.0(3)N1(1)

• IP traffic from static IP source entries that you have configured in the Cisco NX-OS device.

The device permits the IP traffic when DHCP snooping adds a binding table entry for the IP address and MAC

address of an IP packet or when you have configured a static IP source entry.

The device drops IP packets when the IP address and MAC address of the packet do not have a binding table

entry or a static IP source entry. For example, assume that :

MacAddress IpAddress LeaseSec Type VLAN Interface

---------- ---------- --------- ------ ------- ---------

00:02:B3:3F:3B:99 10.5.5.2 6943 dhcp-snooping 10 Ethernet2/3

If the device receives an IP packet with an IP address of 10.5.5.2, IP Source Guard forwards the packet only

if the MAC address of the packet is 00:02:B3:3F:3B:99.

Licensing Requirements for IP Source Guard

This table shows the licensing requirements for IP Source Guard.

License RequirementProduct

IP Source Guard requires no license. Any feature not

included in a license package is bundled with the

Cisco NX-OS

Cisco NX-OS system images and is provided at no

extra charge to you.

Prerequisites for IP Source Guard

Guidelines and Limitations for IP Source Guard

IP Source Guard has the following configuration guidelines and limitations:

• IP Source Guard limits IP traffic on an interface to only those sources that have an IP-MAC address

binding table entry or static IP source entry. When you first enable IP Source Guard on an interface,

you may experience disruption in IP traffic until the hosts on the interface receive a new IP address from

a DHCP server.

• IP Source Guard is dependent upon DHCP snooping to build and maintain the IP-MAC address binding

table or upon manual maintenance of static IP source entries.

Default Settings for IP Source Guard

This table lists the default settings for IP Source Guard parameters.

Table 1: Default IP Source Guard Parameters

DefaultParameters

Disabled on each interface.IP Source Guard

Cisco Nexus 5000 Series NX-OS Security Configuration Guide, Release 5.0(3)N1(1)

Configuring IP Source Guard

Licensing Requirements for IP Source Guard

DefaultParameters

None. No static or default IP source entries exist by

default.

IP source entries

Configuring IP Source Guard

Enabling or Disabling IP Source Guard on a Layer 2 Interface

You can enable or disable IP Source Guard on a Layer 2 interface. By default, IP Source Guard is disabled

on all interfaces.

Before You Begin

Ensure that the DHCP feature is enabled.

SUMMARY STEPS

1. configure terminal

2. interface ethernet slot/port

3. [no]ip verify source dhcp-snooping-vlan

4. (Optional) show running-config dhcp

5. (Optional) copy running-config startup-config

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

switch# configure terminal

switch(config)#

Step 1

Enters interface configuration mode for the specified

interface.

interface ethernet slot/port

Example:

switch(config)# interface ethernet 2/3

switch(config-if)#

Step 2

Enables IP Source Guard on the interface. The no option

disables IP Source Guard on the interface.

[no]ip verify source dhcp-snooping-vlan

Example:

switch(config-if)# ip verify source dhcp-snooping

vlan

Step 3

Cisco Nexus 5000 Series NX-OS Security Configuration Guide, Release 5.0(3)N1(1)

Configuring IP Source Guard

PurposeCommand or Action

(Optional)

Displays the running configuration for DHCP snooping,

including the IP Source Guard configuration.

show running-config dhcp

Example:

switch(config-if)# show running-config dhcp

Step 4

(Optional)

Copies the running configuration to the startup

configuration.

copy running-config startup-config

Example:

switch(config-if)# copy running-config

startup-config

Step 5

Adding or Removing a Static IP Source Entry

You can add or remove a static IP source entry on a device. By default, there are no static IP source entries

on a device.

SUMMARY STEPS

1. configure terminal

2. [no]ip source binding IP-address MAC-address vlan vlan-ID interface ethernet slot/port

3. (Optional) show ip dhcp snooping binding [interface ethernet slot/port]

4. (Optional) copy running-config startup-config

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

switch# configure terminal

switch(config)#

Step 1

Creates a static IP source entry for the current interface,

or if you use the no option, removes a static IP source

entry.

[no]ip source binding IP-address MAC-address vlan

vlan-ID interface ethernet slot/port

Example:

switch(config)# ip source binding 10.5.22.17

001f.28bd.0013 vlan 100 interface ethernet 2/3

Step 2

(Optional)

Displays IP-MAC address bindings for the interface

specified, including static IP source entries. Static entries

appear with the term in the Type column.

show ip dhcp snooping binding [interface ethernet slot/port]

Example:

switch(config)# show ip dhcp snooping binding

interface ethernet 2/3

Step 3

Cisco Nexus 5000 Series NX-OS Security Configuration Guide, Release 5.0(3)N1(1)

Configuring IP Source Guard

Adding or Removing a Static IP Source Entry

PurposeCommand or Action

(Optional)

Copies the running configuration to the startup

configuration.

copy running-config startup-config

Example:

switch(config)# copy running-config startup-config

Step 4

Displaying IP Source Guard Bindings

Use the show ip verify source command to display IP-MAC address bindings.

Configuration Example for IP Source Guard

This example shows how to create a static IP source entry and then how to enable IP Source Guard on an

interface.

ip source binding 10.5.22.17 001f.28bd.0013 vlan 100 interface ethernet 2/3

interface ethernet 2/3

no shutdown

ip verify source dhcp-snooping-vlan

Additional References for IP Source Guard

Standards

TitleStandards

—No new or modified standards are supported by this

feature, and support for existing standards has not

been modified by this feature.

Cisco Nexus 5000 Series NX-OS Security Configuration Guide, Release 5.0(3)N1(1)

Configuring IP Source Guard

Displaying IP Source Guard Bindings

Cisco Nexus 5000 Series NX-OS Security Configuration Guide, Release 5.0(3)N1(1)

Configuring IP Source Guard

Additional References for IP Source Guard

Andere Handbücher für Nexus 5000 Series

Inhaltsverzeichnis

Andere Cisco Schalten Handbücher

Cisco

Cisco IE 3010 Bedienungsanleitung

Cisco

Cisco MDS 9000 Series Bedienungsanleitung

Cisco

Cisco Nexus 3000 series Bedienungsanleitung

Cisco

Cisco Small Business SF200-24 Bedienungsanleitung

Cisco

Cisco IE3400H Leitfaden

Cisco

Cisco 6503 - Catalyst Firewall Security Sys Handbuch

Cisco

Cisco Catalyst 2960 Series Handbuch

Cisco

Cisco AJ732A - MDS 9134 Fabric Switch Betriebsanleitung

Cisco

Cisco Catalyst 4500 E Supervisor Engine 6-E Series Kurzanleitung

Cisco

Cisco RSP2 - Route Switch Processor 2 Bedienerhandbuch

Cisco

Cisco Nexus 3000 series Handbuch

Cisco

Cisco AP776A - Nexus Converged Network Switch 5020 Bedienungsanleitung

Cisco

Cisco Nexus 6000 Bedienungsanleitung

Cisco

Cisco 4503 - Catalyst Switch Administratorhandbuch

Cisco

Cisco MGX 8950 Bedienungs- und Sicherheitshinweise

Cisco

Cisco Catalyst 6816-X-LE Bedienungs- und Sicherheitshinweise

Cisco

Cisco 3750E-24TD - Catalyst Switch - Stackable Handbuch

Cisco

Cisco ME-C3750-24TE-M Handbuch

Cisco

Cisco 500 Series Bedienungsanleitung

Cisco

Cisco 500 Series Bedienungsanleitung

Cisco

Cisco AJ732A - MDS 9134 Fabric Switch Bedienungsanleitung

Cisco

Cisco Nexus 93128TX Bedienungsanleitung

Cisco

Cisco LightStream 1010 Bedienungsanleitung

Cisco

Cisco Catalyst 2960-L Handbuch

Beliebte Schalten Handbücher anderer Marken

URC

URC Total Control MFS-8 Bedienungsanleitung

Azbil

Azbil HPQ-D11 Bedienungsanleitung

Sony

Sony DFS-900M Bedienungsanleitung

SICK

SICK i17S Bedienungsanleitung

F&F

F&F SZR-277 Bedienungsanleitung

Shure

Shure UAMS/BK Bedienungsanleitung

Dräger

Dräger X-zone Switch Off Bedienungsanleitung

Asco

Asco Joucomatic 349 Series Bedienungsanleitung

BT Mini Hub Bedienungsanleitung

D-Link

D-Link DES-1226G Bedienungsanleitung

Johnson Controls

Johnson Controls FS80-C Bedienungsanleitung

MicroNet

MicroNet SP1200A Bedienungsanleitung

Ruijie

Ruijie RG-PF2920 Series Installations- und Betriebsanleitung

Altinex

Altinex DA1914SX Bedienungsanleitung

RJM

RJM MASTERMIND PBC/6X Bedienungsanleitung

Atlas

Atlas MMK-KVM8 Bedienungsanleitung

Cabletron Systems

Cabletron Systems GIGAswitch GSR-16 Bedienungsanleitung

Vimar

Vimar 6592 Montageanleitung