What does IP Source Guard add on top of DHCP snooping and DAI?
Show the answer
Say this first
IP Source Guard filters the data traffic itself, not only ARP. On an untrusted access port it installs a per-port filter that permits only packets sourced from the IP in that port's DHCP snooping binding, and optionally only from the bound MAC too. Everything else is dropped. A host that sets a static IP, or spoofs another host's address to hide an attack, cannot send. DAI stops lies inside ARP; IPSG stops spoofed source addresses in IP packets.
Go deeper
Configuration
interface GigabitEthernet1/0/5
ip verify source
!
ip source binding 0050.5689.0005 vlan 10 10.10.10.5 interface GigabitEthernet1/0/6ip verify source filters on source IP. To filter on IP and MAC together, older Catalyst releases
use ip verify source port-security, which needs port security on the port, and Catalyst 9000 uses
ip verify source mac-check. The ip source binding line adds a static entry for a fixed-address host.
ASW1# show ip verify source
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- ----------------- ----
Gi1/0/5 ip active 10.10.10.51 10Before the client has a lease, the port drops all IP traffic except DHCP.
Compared with uRPF
uRPF is a router feature that checks the source against the routing table per interface, so it stops spoofing of whole subnets at the edge. IPSG is per host, at the access port, against the lease. For IPv6 the equivalent is IPv6 Source Guard, part of the switch's device-tracking feature set.
They will ask next
Why might every host on a switch lose connectivity after a reload with IPSG on?
The binding table is empty after boot. Until clients renew their leases, their traffic is dropped. The DHCP snooping database agent, which saves the table to flash or a server, prevents it.
What does IPSG cost?
Hardware filter entries per port. On large access switches with many ports the ACL resources are finite, so check the platform's limits.
Traps
- Enabling IPSG on a VLAN where DHCP snooping is not enabled. There are no bindings, so everything is dropped.