Configuring Ip Source Guard On Private Vlans - Cisco 4500M Software Manual

Configuring IP Source Guard on the Switch
Command
Step 5
Switch(config-if)# switchport port-security limit
rate invalid-source-mac N
Step 6
Switch(config)# ip source binding ip-addr ip vlan
number interface interface
Step 7
Switch(config)# end
Step 8
Switch# show ip verify source interface
interface-name
Note The static IP source binding can only be configured on switch port. If you issue the
ip source binding vlan interface command on a Layer 3 port, you will receive this error message:
Static IP source binding can only be configured on switch port
This example shows how to enable per-Layer 2-port IP source guard on VLANs 10 through 20:
Switch# configure terminal
Enter configuration commands, one per line.
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10 20
Switch(config)# interface fa6/1
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 10
Switch(config-if)# switchport trunk allowed vlan 11-20
Switch(config-if)# no ip dhcp snooping trust
Switch(config-if)# ip verify source vlan dhcp-snooping
Switch(config)# end
Switch# sh ip verify source interface f6/1
Interface
---------
Fa6/1
Fa6/1
Switch#
The output shows that there is one valid DHCP binding to VLAN 10.

Configuring IP Source Guard on Private VLANs

For private VLAN ports, you must enable DHCP snooping on primary VLANs in order for IP source
guard to be effective. IP source guard on a primary VLAN will automatically propagate to a secondary
VLAN. Configuring a static IP source binding on a secondary VLAN is allowed, but it will not take
effect. When manually configuring a static IP source binding on a secondary VLAN, you will receive
the following warning:
Warning IP source filter may not take effect on secondary vlan where IP source binding is configured. If private
vlan feature is enabled, IP source filter on primary vlan will automatically propagate to all secondary
vlans.
Software Configuration Guide—Release 12.2(25)EW
33-12
Filter-type Filter-mode
----------- -----------
ip-mac active
ip-mac active
Chapter 33 Configuring DHCP Snooping and IP Source Guard
Purpose
Enables security rate limiting for learned source MAC
addresses on the port.
This limit only applies to the port where IP
Note
Source Guard is enabled as filtering both IP and
MAC addresses.
Configures a static IP binding on the port.
Exits configuration mode.
Verifies the configuration.
End with CNTL/Z.
IP-address Mac-address
--------------- -----------------
10.0.0.1
deny-all
.
Vlan
----------
10
11-20
OL-6696-01