You can enable IP Source Guard (IPSG) only on a port that is DHCP Snooping and Dynamic ARP Inspection untrusted.
The port must be a member of a VLAN. DHCP Snooping must be enabled globally and on the VLAN. You must also enable Dynamic ARP Inspection on the same VLAN.
You cannot enable IPSG on MLT, SMLT, DMLT or LAG ports.
You cannot enable IPSG on a brouter port.
You cannot enable IPSG on ports that are members of a private VLAN.
You cannot remove a port that is IPSG-enabled from a VLAN. Similarly, you cannot delete a VLAN that has at least one port that is IPSG-enabled.
A maximum of 10 IP addresses are allowed on each IPSG-enabled port. Correspondingly, a maximum of 10 IP filters are automatically created for each of those ports. When this number is reached, no more filters are set up and all traffic is dropped.
On the switch, the total number of IP filters must not exceed 256. This limit includes both IP filters that are automatically created on IPSG ports and the manually created ACLs.