IP Source Guard

IP Source Guard (IPSG) is a Layer 2 port-to-port feature that works closely with DHCP Snooping. It prevents IP spoofing by allowing only IP addresses obtained using DHCP Snooping. When you enable IPSG on an untrusted port with DHCP Snooping enabled, an IP filter is automatically created or deleted for that port based on the information stored in the corresponding DHCP Snooping binding table entry. When a connecting client receives a valid IP address from the DHCP server, the filter installed on the port allows traffic only from that assigned IP address.

You can configure IPSG on a port using the command line interface (CLI), the Enterprise Device Manager (EDM), or SNMP.

Note

The switch supports configuration of IP Source Guard for both IPv4 and IPv6 addresses.

Important

If you enable Application Telemetry, IPv6 Source Guard commands and configurations are blocked and not available on VSP 4450 Series, VSP 4900 Series, VSP 7200 Series, and VSP 8000 Series switches.

The following table shows how IPSG works with DHCP Snooping.