How to Configure IP Source Guard (IPSG): A Beginner's Guide
TIMESTAMPS:
0:00 Introduction
0:53 How IP Source Guard (IPSG) and IP Spoofing attacks work
2:44 How to configure IPSG
6:38 Verification Commands
7:40 Conclusion
IP Source Guard (IPSG)
You can use IP Source Guard to prevent IP spoofing when a host tries to use a random or the IP address of its neighbor.
Uses the DHCP snooping database and static IP source binding entries.
The switch blocks all IP traffic received on the interface except for DHCP packets allowed by DHCP snooping.
IPSG is supported only on Layer 2 ports, including access and trunk ports.
Can be enabled on untrusted ports.
How does IP Source Guard work
Packets arriving on a switch port can be tested in two ways:
The source IP address must be identical to the IP address learned by DHCP snooping or a static entry.
The source MAC address must be identical to the MAC address learned on the switch port and by DHCP snooping.
Configuring IP Source Guard
Note: Configure DHCP Snooping as a prerequisite.
ACC_SW1:
conf t
int g0/0
switchport mode access
switchport port-security
ip verify source port-security
end
wr
!
ACC_SW2:
conf t
int g0/0
switchport mode access
switchport port-security
ip verify source port-security
end
wr
!
Configuring an IP source binding
switch(config)# ip source binding mac-address vlan vlan-id ip-address interface
type member/module/number
Verifying IP Source Guard
show ip verify source
!To verify the information contained in the IP source binding database.
show ip source binding
🔔 Subscribe to my YouTube channel:
/ @ferdstechchannel
References:
https://packetpushers.net/ccnp-studie...
https://www.ciscopress.com/articles/a...
https://www.cisco.com/c/en/us/td/docs...
Document:
https://drive.google.com/file/d/1PLFI...
#cisco #ccna #ccnp #cisconetworking