Enable IP Source Guard on a Port for IPv4 Addresses

About this task

Enable IP Source Guard (IPSG) on a port to add a higher level of security to the port by preventing IP spoofing. When you enable IPSG on the interface, filters are automatically installed for the IPv4 addresses that are already learned on that interface.

Important

Do not enable IPSG on MLT, DMLT, SMLT, LAG, trunk ports or ports that are a part of private VLANs.

1. Enter GigabitEthernet Interface Configuration mode:

   enable

   configure terminal

   interface GigabitEthernet {slot/port[/sub-port][-slot/port[/sub-port]][,...]}

   

   Note

   If the platform supports channelization and the port is channelized, you must also specify the sub-port in the format slot/port/sub-port.

2. Enable IPSG on the port:

   ip source verify enable

3. Verify IPSG configuration:

   show ip source verify interface gigabitethernet [{slot/port[/sub-port] [-slot/port[/sub-port]] [,...]}]

Example

Configure IPSG on port 4/1.

Switch:1>enable
Switch:1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch:1(config)#interface gigabitEthernet 4/1
Switch:1(config-if)#ip source verify enable 

Verify the configuration.

Switch:1(config-if)#show ip source verify interface gigabitEthernet

===================================================================================
                             Source Guard Port Info
===================================================================================
PORT                     IPSC
NUM        ENABLE        ORIGIN
-----------------------------------------------------------------------------------
1/1        false         RADIUS
1/2        false         RADIUS
4/1        true          RADIUS
4/2        false         RADIUS
4/3        false         RADIUS
4/4        false         RADIUS
4/5        false         RADIUS
4/6        false         RADIUS
-----------------------------------------------------------------------------------

All 8 out of 8 Total Num of Ip Source Guard entries displayed

Switch:1(config-if)#show ip source verify interface gigabitEthernet 4/1

===================================================================================
                             Source Guard Port Info
===================================================================================
PORT                     IPSC
NUM        ENABLE        ORIGIN
-----------------------------------------------------------------------------------
4/1        true          RADIUS  
-----------------------------------------------------------------------------------

All 1 out of 1 Total Num of Ip Source Guard entries displayed