ZyXEL Communications MES-2110 Guía de usuario descargar pdf (Pagina 119)

MES-2110 User’s Guide

119

CHAPTER 17

IP Source Guard

17.1 Overview

IP source guard uses a binding table to distinguish between authorized and

unauthorized DHCP and ARP frames in your network. A binding contains these key

attributes:

• MAC address

•VLAN ID

• IP address

•Port number

When the Switch receives a DHCP or ARP frame, it looks up the appropriate MAC

address, VLAN ID, IP address, and port number in the binding table. If there is a

binding, the Switch forwards the frame. If there is not a binding, the Switch

discards the frame.

The Switch builds the binding table by snooping DHCP frames (dynamic bindings)

and from information provided manually by administrators (static bindings).

IP source guard consists of the following features:

• Static bindings. Use this to create static bindings in the binding table.

• DHCP snooping. Use this to filter unauthorized DHCP frames on the network and

to build the binding table dynamically.

• ARP inspection. Use this to filter unauthorized ARP frames on the network.

If you want to use dynamic bindings to filter unauthorized ARP frames (typical

implementation), you have to enable DHCP snooping before you enable ARP

inspection.

17.1.1 DHCP Snooping Overview

Use DHCP snooping to filter unauthorized DHCP frames on the network and to

build the binding table dynamically. This can prevent clients from getting IP

addresses from unauthorized DHCP servers.

1 2 ... 114 115 116 117 118 119 120 121 122 123 124 ... 183 184

Sin comentarios

ZyXEL Communications MES-2110 Guía de usuario Pagina 119