You must configure the ip device tracking
maximum
limit-number interface configuration command globally for IPSG
for static hosts to work. If you only configure this command on a port without
enabling IP device tracking globally or by setting an IP device tracking maximum on
that interface, IPSG with static hosts rejects all the IP traffic from that
interface. This requirement also applies to IPSG with static hosts on a private VLAN
host port.
Eight Examples
This example shows how to stop IPSG with static hosts on an interface.
Device(config-if)# no ip verify source
Device(config-if)# no ip device tracking max
This example shows how to enable IPSG with static hosts on a port.
Device(config)# ip device tracking
Device(config-if)# ip device tracking maximum 10
Device(config-if)# ip verify source tracking
This example shows how to enable IPSG for static hosts with IP filters on a Layer 2 access port and to verify the valid IP
bindings on the interface Gi1/0/3:
Device# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Device(config)# ip device tracking
Device(config)# interface gigabitethernet1/0/3
Device(config-if)# switchport mode access
Device(config-if)# switchport access vlan 10
Device(config-if)# ip device tracking maximum 5
Device(config-if)# ip verify source tracking
Device(config-if)# end
Device# show ip verify source
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- ----------------- ----
Gi1/0/3 ip trk active 40.1.1.24 10
Gi1/0/3 ip trk active 40.1.1.20 10
Gi1/0/3 ip trk active 40.1.1.21 10
This example shows how to enable IPSG for static hosts with IP-MAC filters on a Layer 2 access port, to verify the valid IP-MAC
bindings on the interface Gi1/0/3, and to verify that the number of bindings on this interface has reached the maximum:
Device# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Device(config)# ip device tracking
Device(config)# interface gigabitethernet1/0/3
Device(config-if)# switchport mode access
Device(config-if)# switchport access vlan 1
Device(config-if)# ip device tracking maximum 5
Device(config-if)# ip verify source tracking
Device(config-if)# end
Device# show ip verify source
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- ----------------- ----
Gi1/0/3 ip trk active deny-all 1
This example displays all IP or MAC binding entries for all interfaces. The CLI displays all active as well as inactive entries.
When a host is learned on a interface, the new entry is marked as active. When the same host is disconnected from that interface
and connected to a different interface, a new IP or MAC binding entry displays as active as soon as the host is detected.
The old entry for this host on the previous interface is marked as INACTIVE.
Device# show ip device tracking all
IP Device Tracking for wireless clients = Enabled
Global IP Device Tracking for wired clients = Enabled
Global IP Device Tracking Probe Count = 3
Global IP Device Tracking Probe Interval = 30
-----------------------------------------------------------------------------------------------
IP Address MAC Address Vlan Interface Probe-Timeout STATE
-----------------------------------------------------------------------------------------------
200.1.1.8 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.9 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.10 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.1 0001.0600.0000 9 GigabitEthernet1/0/2 ACTIVE
200.1.1.1 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.2 0001.0600.0000 9 GigabitEthernet1/0/2 ACTIVE
200.1.1.2 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.3 0001.0600.0000 9 GigabitEthernet1/0/2 ACTIVE
200.1.1.3 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.4 0001.0600.0000 9 GigabitEthernet1/0/2 ACTIVE
200.1.1.4 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.5 0001.0600.0000 9 GigabitEthernet1/0/2 ACTIVE
200.1.1.5 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.6 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.7 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
This example displays all active IP or MAC binding entries for all interfaces:
Device# show ip device tracking all active
IP Device Tracking for wireless clients = Enabled
Global IP Device Tracking for wired clients = Enabled
Global IP Device Tracking Probe Count = 3
Global IP Device Tracking Probe Interval = 30
-----------------------------------------------------------------------------------------------
IP Address MAC Address Vlan Interface Probe-Timeout STATE
-----------------------------------------------------------------------------------------------
200.1.1.1 0001.0600.0000 9 GigabitEthernet1/0/1 ACTIVE
200.1.1.2 0001.0600.0000 9 GigabitEthernet1/0/1 ACTIVE
200.1.1.3 0001.0600.0000 9 GigabitEthernet1/0/1 ACTIVE
200.1.1.4 0001.0600.0000 9 GigabitEthernet1/0/1 ACTIVE
200.1.1.5 0001.0600.0000 9 GigabitEthernet1/0/1 ACTIVE
This example displays all inactive IP or MAC binding entries for all interfaces. The host was first learned on GigabitEthernet
1/0/1 and then moved to GigabitEthernet 0/2. the IP or MAC binding entries learned on GigabitEthernet1/ 0/1 are marked as
inactive.
Device# show ip device tracking all inactive
IP Device Tracking for wireless clients = Enabled
Global IP Device Tracking for wired clients= Enabled
Global IP Device Tracking Probe Count = 3
Global IP Device Tracking Probe Interval = 30
-----------------------------------------------------------------------------------------------
IP Address MAC Address Vlan Interface Probe-Timeout STATE
-----------------------------------------------------------------------------------------------
200.1.1.8 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.9 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.10 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.1 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.2 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.3 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.4 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.5 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.6 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
200.1.1.7 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE
This example displays the count of all IP device tracking host entries for all interfaces:
Device# show ip device tracking all count
Total IP Device Tracking Host entries: 5
---------------------------------------------------------------------
Interface Maximum Limit Number of Entries
---------------------------------------------------------------------
Gi1/0/3 5