Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide, 12.2(20)EWA

Configuring DHCP Snooping and IP Source Guard

This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP) snooping and IP Source Guard on Catalyst 4500 series switches. It provides guidelines, procedures, and configuration examples.

This chapter consists of the following major sections:

•Overview of DHCP Snooping

•Configuring DHCP Snooping on the Switch

•Displaying DHCP Snooping Information

•Overview of IP Source Guard

•Configuring IP Source Guard on the Switch

•Displaying IP Source Guard Information

•Displaying IP Source Binding Information

Note For complete syntax and usage information for the switch commands used in this chapter, first look at the Cisco Catalyst 4500 Series Switch Command Reference and related publications at this location:

http://www.cisco.com/en/US/products//hw/switches/ps4324/index.html

If the command is not found in the Catalyst 4500 Command Reference, it will be found in the larger Cisco IOS library. Refer to the Catalyst 4500 Series Switch Cisco IOS Command Reference and related publications at this location:

http://www.cisco.com/en/US/products/ps6350/index.html

Overview of DHCP Snooping

DHCP snooping is a DHCP security feature that provides security by filtering untrusted DHCP messages and by building and maintaining a DHCP snooping binding table. An untrusted message is a message that is received from outside the network or firewall and that can cause traffic attacks within your network.

The DHCP snooping binding table contains the MAC address, IP address, lease time, binding type, VLAN number, and interface information that corresponds to the local untrusted interfaces of a switch; it does not contain information regarding hosts interconnected with a trusted interface. An untrusted interface is an interface that is configured to receive messages from outside the network or firewall. A trusted interface is an interface that is configured to receive only messages from within the network.

DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. It also gives you a way to differentiate between untrusted interfaces connected to the end-user and trusted interfaces connected to the DHCP server or another switch.

Note In order to enable DHCP snooping on a VLAN, you must enable DHCP snooping on the switch.

You can configure DHCP snooping for switches and VLANs. When you enable DHCP snooping on a switch, the interface acts as a Layer 2 bridge, intercepting and safeguarding DHCP messages going to a Layer 2 VLAN. When you enable DHCP snooping on a VLAN, the switch acts as a Layer 2 bridge within a VLAN domain.

Overview of the DHCP Snooping Database Agent

To retain the bindings across switch reloads, you must use the DHCP snooping database agent. Without this agent, the bindings established by DHCP snooping are lost upon switch reload. Connectivity is lost as well.

The mechanism for the database agent stores the bindings in a file at a configured location. Upon reload, the switch reads the file to build the database for the bindings. The switch keeps the file current by writing to the file as the database changes.

The format of the file that contains the bindings is as follows:

<initial-checksum>

TYPE DHCP-SNOOPING

VERSION 1

BEGIN

<entry-1> <checksum-1>

<entry-2> <checksum-1-2>

...

...

<entry-n> <checksum-1-2-..-n>

END

Each entry in the file is tagged with a checksum that is used to validate the entries whenever the file is read. The <initial-checksum> entry on the first line helps distinguish entries associated with the latest write from entries that are associated with a previous write.

This is a sample bindings file:

3ebe1518

TYPE DHCP-SNOOPING

VERSION 1

BEGIN

1.1.1.1 512 0001.0001.0005 3EBE2881 Gi1/1                                e5e1e733

1.1.1.1 512 0001.0001.0002 3EBE2881 Gi1/1                                4b3486ec

1.1.1.1 1536 0001.0001.0004 3EBE2881 Gi1/1                               f0e02872

1.1.1.1 1024 0001.0001.0003 3EBE2881 Gi1/1                               ac41adf9

1.1.1.1 1 0001.0001.0001 3EBE2881 Gi1/1                                  34b3273e

END

Each entry holds an IP address, VLAN, MAC address, lease time (in hex), and the interface associated with a binding. At the end of each entry is a checksum that accounts for all the bytes from the start of the file through all the bytes associated with the entry. Each entry consists of 72 bytes of data, followed by a space, followed by a checksum.

Upon bootup, when the calculated checksum equals the stored checksum, a switch reads entries from the file and adds the bindings to the DHCP snooping database. When the calculated checksum does not equal the stored checksum, the entry read from the file is ignored and so are all the entries following the failed entry. The switch also ignores all those entries from the file whose lease time has expired. (This situation is possible because the lease time might indicate an expired time.) An entry from the file is also ignored if the interface referred to in the entry, no longer exists on the system or if it is a router port or a DHCP snooping-trusted interface.

When a switch learns of new bindings or when it loses some bindings, the switch writes the modified set of entries from the snooping database to the file. The writes are performed with a configurable delay to batch as many changes as possible before the actual write happens. Associated with each transfer is a timeout after which a transfer is aborted if it is not completed. These timers are referred to as the write delay and abort timeout.

Configuring DHCP Snooping on the Switch

When you configure DHCP snooping on your switch, you are enabling the switch to differentiate untrusted interfaces from trusted interfaces. You must enable DHCP snooping globally before you can use DHCP snooping on a VLAN. You can enable DHCP snooping independently from other DHCP features.

Once you have enabled DHCP snooping, all the DHCP relay information option configuration commands are disabled; this includes the following commands:

•ip dhcp relay information check

•ip dhcp relay information policy

•ip dhcp relay information trusted

•ip dhcp relay information trust-all

These sections describe how to configure DHCP snooping:

•Default Configuration for DHCP Snooping

•Enabling DHCP Snooping

•Enabling DHCP Snooping on Private VLAN

•Enabling the DHCP Snooping Database Agent

•Configuration Examples for the Database Agent

Note For DHCP server configuration information, refer to "Configuring DHCP" in the Cisco IOS IP and IP Routing Configuration Guide at:

http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfdhcp.html

Default Configuration for DHCP Snooping

DHCP snooping is disabled by default. Table 31-1 shows all the default configuration values for each DHCP snooping option.

If you want to change the default configuration values, see the "Enabling DHCP Snooping" section.

Enabling DHCP Snooping

Note When DHCP snooping is enabled globally, DHCP requests are dropped until the ports are configured. Consequently, you should probably configure this feature during a maintenance window and not during production.

To enable DHCP snooping, perform this task:

Switch(config)# ip dhcp snooping 

Switch(config)# ip dhcp snooping vlan number 
[number] | vlan {vlan range}]

Switch(config-if)# ip dhcp snooping trust

Switch(config-if)# ip dhcp snooping limit rate 
rate

Switch(config)# end 

Switch# show ip dhcp snooping 

You can configure DHCP snooping for a single VLAN or a range of VLANs. To configure a single VLAN, enter a single VLAN number. To configure a range of VLANs, enter a beginning and an ending VLAN number or a dash and range of VLANs.

This example shows how to enable DHCP snooping on VLANs 10 through 100:

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip dhcp snooping

Switch(config)# ip dhcp snooping vlan 10 100

Switch(config)# interface GigabitEthernet 5/1

Switch(config-if)# ip dhcp snooping trust

Switch(config-if)# interface FastEthernet 2/1

Switch(config-if)# ip dhcp snooping limit rate 100

Switch(config)# end

Switch# show ip dhcp snooping

Switch DHCP snooping is enabled.

DHCP Snooping is configured on the following VLANs:

    10-100

Insertion of option 82 information is enabled.

Interface           Trusted        Rate limit (pps)

---------           -------        ----------------

FastEthernet2/1     yes            100

FastEthernet2/2     yes            none

FastEthernet3/1     no             20

GigabitEthernet5/1     yes            none

Switch# 

The following configuration describes the DHCP snooping configuration steps if routing is defined on another Catalyst switch (for example, a Catalyst 6500 series switch):

// Trust the uplink gigabit Ethernet trunk port

interface range GigabitEthernet 1/1 - 2

switchport mode trunk

switchport trunk encapsulation dot1q

ip dhcp snooping trust

! 

interface VLAN 14

ip address 10.33.234.1 255.255.254.0

ip helper-address 10.5.1.2

Note If you are enabling trunking on uplink gigabit interfaces, and the above routing configuration is defined on a Catalyst 6500 series switch, you must configure the "trust" relationship with downstream DHCP Snooping (on a Catalyst 4500 series switch) which adds Option 82. On a Catalyst 6500 series switch, this task is accomplished with ip dhcp relay information trusted VLAN configuration command.

Enabling DHCP Snooping on Private VLAN

DHCP snooping can be enabled on private VLANs, which provide isolation between Layer 2 ports within the same VLAN. If DHCP snooping is enabled (or disabled), the configuration is propagated to both the primary VLAN and its associated secondary VLANs. You cannot enable (or disable) DHCP snooping on a primary VLAN without reflecting this configuration change on the secondary VLANs.

Configuring DHCP snooping on a secondary VLAN is still allowed, but it will not take effect if the associated primary VLAN is already configured. If the associated primary VLAN is configured, the effective DHCP snooping mode on the secondary VLAN is derived from the corresponding primary VLAN. Manually configuring DHCP snooping on a secondary VLAN will cause the switch to issue this warning message:

DHCP Snooping configuration may not take effect on secondary vlan XXX 

The show ip dhcp snooping command will display all VLANs (both primary and secondary) that have DHCP snooping enabled.

Enabling the DHCP Snooping Database Agent

To configure the database agent, perform one or more of the following tasks:

Switch(config)# ip dhcp snooping database { url | 
write-delay seconds | timeout seconds }

Switch(config)# no ip dhcp snooping database 
[write-delay | timeout]

Switch# show ip dhcp snooping database [detail]

Switch# clear ip dhcp snooping database statistics

Switch# renew ip dhcp snooping database [validation 
none] [url]

Switch# ip dhcp snooping binding mac-addr vlan vlan 
ipaddr interface ifname expiry lease-in-seconds

Switch# no ip dhcp snooping binding mac-addr vlan 
vlan ipaddr interface ifname

Note Because both NVRAM and bootflash have limited storage capacity, storing a file on an TFTP server is preferred. Moreover, when a file is stored in a remote location accessible through TFTP, an RPR standby supervisor engine can take over the binding list when a switchover occurs.

Note Network-based URLs (such as TFTP and FTP) require that you create an empty file at the configured URL before the switch can write the set of bindings for the first time.

Configuration Examples for the Database Agent

The following examples show how to use the above commands.

Example 1: Enabling the Database Agent

The following example shows how to configure the DHCP snooping database agent to store the bindings at a given location and to view the configuration and operating state:

Switch# configure terminal

Switch(config)# ip dhcp snooping database tftp://10.1.1.1/directory/file

Switch(config)# end

Switch# show ip dhcp snooping database detail

Agent URL : tftp://10.1.1.1/directory/file

Write delay Timer : 300 seconds

Abort Timer : 300 seconds

Agent Running : No

Delay Timer Expiry : 7 (00:00:07)

Abort Timer Expiry : Not Running

Last Succeded Time : None

Last Failed Time : 17:14:25 UTC Sat Jul 7 2001

Last Failed Reason : Unable to access URL.

Total Attempts       :       21   Startup Failures :        0

Successful Transfers :        0   Failed Transfers :       21

Successful Reads     :        0   Failed Reads     :        0

Successful Writes    :        0   Failed Writes    :       21

Media Failures       :        0

First successful access: Read

Last ignored bindings counters :

Binding Collisions    :        0   Expired leases    :        0

Invalid interfaces    :        0   Unsupported vlans :        0

Parse failures        :        0

Last Ignored Time : None

Total ignored bindings counters:

Binding Collisions    :        0   Expired leases    :        0

Invalid interfaces    :        0   Unsupported vlans :        0

Parse failures        :        0

Switch#

The first three lines of output show the configured URL and related timer configuration values. The next three lines show the operating state and the amount of time left for expiry of write delay and abort timers.

Among the statistics shown in the output, startup failures indicate the number of attempts the read or create of the file has failed upon bootup.

Note Because the location is based off in the network, you must create a temporary file on the TFTP server. You can create a temporary file on a typical UNIX workstation by creating a 0 byte file "file" in the directory "directory" that can be referenced by the TFTP server daemon. With some server implementations on UNIX workstations, the file should be provided with full (777) permissions for write access to the file.

DHCP snooping bindings are keyed on the MAC address and VLAN combination. Therefore, if an entry in the remote file has an entry for a given MAC address and VLAN set, for which the switch already has a binding, the entry from the remote file is ignored when the file is read. This condition is referred to as the binding collision.

An entry in a file may no longer be valid because the lease indicated by the entry may have expired by the time it is read. The expired leases counter indicates the number of bindings ignored because of this condition. The Invalid interfaces counter refers to the number of bindings that have been ignored when the interface referred by the entry either does not exist on the system or is a router or DHCP snooping trusted interface if it exists, when the read happened. Unsupported VLANs refers to the number of entries that have been ignored because the indicated VLAN is not supported on the system. The Parse failures counter provides the number of entries that have been ignored when the switch is unable to interpret the meaning of the entries from the file.

The switch maintains two sets of counters for these ignored bindings. One provides the counters for a read that has at least one binding ignored by at least one of these conditions. These counters are shown as the "Last ignored bindings counters." The total ignored bindings counters provides a sum of the number of bindings that have been ignored because of all the reads since the switch bootup. These two set of counters are cleared by the clear command. Therefore, the total counter set may indicate the number of bindings that have been ignored since the last clear.

Example 2: Reading Binding Entries from a TFTP File

To manually read the entries from a TFTP file, perform this task:

Switch# sh ip dhcp snooping database

Switch# renew ip dhcp snoop data url

Switch# sh ip dhcp snoop data 

Switch# sh ip dhcp snoop bind

This is an example of how to manually read entries from the tftp://10.1.1.1/directory/file:

Switch# sh ip dhcp snooping database

Agent URL : 

Write delay Timer : 300 seconds

Abort Timer : 300 seconds

Agent Running : No

Delay Timer Expiry : Not Running

Abort Timer Expiry : Not Running

Last Succeded Time : None

Last Failed Time : None

Last Failed Reason : No failure recorded.

Total Attempts       :        0   Startup Failures :        0

Successful Transfers :        0   Failed Transfers :        0

Successful Reads     :        0   Failed Reads     :        0

Successful Writes    :        0   Failed Writes    :        0

Media Failures       :        0

Switch#

Switch# renew ip dhcp snoop data tftp://10.1.1.1/directory/file

Loading directory/file from 10.1.1.1 (via GigabitEthernet1/1): !

[OK - 457 bytes]

Database downloaded successfully.

Switch#

00:01:29: %DHCP_SNOOPING-6-AGENT_OPERATION_SUCCEEDED: DHCP snooping database Read 
succeeded.

Switch#

Switch# sh ip dhcp snoop data

Agent URL : 

Write delay Timer : 300 seconds

Abort Timer : 300 seconds

Agent Running : No

Delay Timer Expiry : Not Running

Abort Timer Expiry : Not Running

Last Succeded Time : 15:24:34 UTC Sun Jul 8 2001

Last Failed Time : None

Last Failed Reason : No failure recorded.

Total Attempts       :        1   Startup Failures :        0

Successful Transfers :        1   Failed Transfers :        0

Successful Reads     :        1   Failed Reads     :        0

Successful Writes    :        0   Failed Writes    :        0

Media Failures       :        0

Switch#

Switch# sh ip dhcp snoop bind

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

00:01:00:01:00:05   1.1.1.1          49810       dhcp-snooping  512   GigabitEthernet1/1

00:01:00:01:00:02   1.1.1.1          49810       dhcp-snooping  512   GigabitEthernet1/1

00:01:00:01:00:04   1.1.1.1          49810       dhcp-snooping  1536  GigabitEthernet1/1

00:01:00:01:00:03   1.1.1.1          49810       dhcp-snooping  1024  GigabitEthernet1/1

00:01:00:01:00:01   1.1.1.1          49810       dhcp-snooping  1     GigabitEthernet1/1

Switch#

Switch#clear ip dhcp snoop bind

Switch#sh ip dhcp snoop bind   

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

Switch#

Example 3: Adding Information to the DHCP Snooping Database

To manually add a binding to the DHCP snooping database, perform the following task:

Switch# show ip dhcp snooping binding

Switch# ip dhcp snooping binding binding-id vlan 
vlan-id interface interface expiry lease-time

Switch# show ip dhcp snooping binding 

This example shows how to manually add a binding to the DHCP snooping database:

Switch# show ip dhcp snooping binding

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

Switch#

Switch# ip dhcp snooping binding 1.1.1 vlan 1 1.1.1.1 interface gi1/1 expiry 1000

Switch# show ip dhcp snooping binding

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

00:01:00:01:00:01   1.1.1.1          992         dhcp-snooping  1     GigabitEthernet1/1

Switch#

Displaying DHCP Snooping Information

You can display a DHCP snooping binding table and configuration information for all interfaces on a switch.

Displaying a Binding Table

The DHCP snooping binding table for each switch contains binding entries that correspond to untrusted ports. The table does not contain information about hosts interconnected with a trusted port because each interconnected switch will have its own DHCP snooping binding table.

This example shows how to display the DHCP snooping binding information for a switch:

Switch# sh ip dhcp snooping binding

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

00:02:B3:3F:3B:99   55.5.5.2         6943        dhcp-snooping  10    FastEthernet6/10

Switch#

Table 31-2 describes the fields in the show ip dhcp snooping binding command output.

Displaying the DHCP Snooping Configuration

This example shows how to display the DHCP snooping configuration for a switch.

Switch# show ip dhcp snooping

Switch DHCP snooping is enabled.

DHCP Snooping is configured on the following VLANs:

    10 30-40 100 200-220

Insertion of option 82 information is enabled.

Interface           Trusted        Rate limit (pps)

---------           -------        ----------------    

FastEthernet2/1     yes            10

FastEthernet3/1     yes            none

GigabitEthernet1/1  no             20

Switch#

Overview of IP Source Guard

Similar to DHCP snooping, this feature is enabled on a DHCP snooping untrusted Layer 2 port. Initially, all IP traffic on the port is blocked except for DHCP packets that are captured by the DHCP snooping process. When a client receives a valid IP address from the DHCP server, or when a static IP source binding is configured by the user, a per-port and VLAN Access Control List (PVACL) is installed on the port. This process restricts the client IP traffic to those source IP addresses configured in the binding; any IP traffic with a source IP address other than that in the IP source binding will be filtered out. This filtering limits a host's ability to attack the network by claiming a neighbor host's IP address.

Note If IP Source Guard is enabled on a trunk port with a large number of VLANs that have DHCP snooping enabled, you might run out of ACL hardware resources, and some packets might be switched in software instead.

Note When IP Source Guard is enabled, you might want to designate an alternative scheme for ACL hardware programming. For more information, see the "TCAM Programming and ACLs" section in the "Configuring Network Security with ACLs" chapter.

IP Source Guard supports the Layer 2 port only, including both access and trunk. For each untrusted Layer 2 port, there are two levels of IP traffic security filtering:

•Source IP address filter

IP traffic is filtered based on its source IP address. Only IP traffic with a source IP address that matches the IP source binding entry is permitted.

An IP source address filter is changed when a new IP source entry binding is created or deleted on the port. The port PVACL will be recalculated and reapplied in the hardware to reflect the IP source binding change. By default, if the IP filter is enabled without any IP source binding on the port, a default PVACL that denies all IP traffic is installed on the port. Similarly, when the IP filter is disabled, any IP source filter PVACL will be removed from the interface.

•Source IP and MAC address filter

IP traffic is filtered based on its source IP address as well as its MAC address; only IP traffic with source IP and MAC addresses matching the IP source binding entry are permitted.

Note When IP source guard is enabled in IP and MAC filtering mode, the DHCP snooping option 82 must be enabled to ensure that the DHCP protocol works properly. Without option 82 data, the switch cannot locate the client host port to forward the DHCP server reply. Instead, the DHCP server reply is dropped, and the client cannot obtain an IP address.

Configuring IP Source Guard on the Switch

To enable IP Source Guard, perform this task:

Switch(config)# ip dhcp snooping 

Switch(config)# ip dhcp snooping vlan number 
[number]

Switch(config-if)# no ip dhcp snooping trust

Switch(config-if)# ip verify source vlan 
dhcp-snooping port-security

Switch(config-if)# switchport port-security limit 
rate invalid-source-mac N

Switch(config)# ip source binding ip-addr ip vlan 
number interface interface

Switch(config)# end 

Switch# show ip verify source interface 
interface-name

Note The static IP source binding can only be configured on switch port. If you issue the
ip source binding vlan interface command on a Layer 3 port, you will receive this error message: Static IP source binding can only be configured on switch port.

This example shows how to enable per-Layer 2-port IP source guard on VLANs 10 through 20:

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip dhcp snooping

Switch(config)# ip dhcp snooping vlan 10 20

Switch(config)# interface fa6/1

Switch(config-if)# switchport trunk encapsulation dot1q

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk native vlan 10

Switch(config-if)# switchport trunk allowed vlan 11-20

Switch(config-if)# no ip dhcp snooping trust

Switch(config-if)# ip verify source vlan dhcp-snooping

Switch(config)# end

Switch# sh ip verify source interface f6/1

Interface  Filter-type  Filter-mode  IP-address       Mac-address        Vlan

---------  -----------  -----------  ---------------  -----------------  ----------

Fa6/1      ip-mac       active       10.0.0.1                            10  

Fa6/1      ip-mac       active       deny-all                            11-20  

Switch#

The output shows that there is one valid DHCP binding to VLAN 10.

Configuring IP Source Guard on Private VLANs

For private VLAN ports, you must enable DHCP snooping on primary VLANs in order for IP source guard to be effective. IP source guard on a primary VLAN will automatically propagate to a secondary VLAN. Configuring a static IP source binding on a secondary VLAN is allowed, but it will not take effect. When manually configuring a static IP source binding on a secondary VLAN, you will receive the following warning:

Warning IP source filter may not take effect on secondary vlan where IP source binding is configured. If private vlan feature is enabled, IP source filter on primary vlan will automatically propagate to all secondary vlans.

Displaying IP Source Guard Information

You can display IP Source Guard PVACL information for all interfaces on a switch using the
show ip verify source command.

•This example shows displayed PVACLs if DHCP snooping is enabled on VLAN 10 through 20, if interface fa6/1 is configured for IP filtering, and if there is an existing IP address binding 10.0.01 on VLAN 10:

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

fa6/1      ip           active       10.0.0.1                         10

fa6/1      ip           active       deny-all                         11-20

Note The second entry shows that a default PVACL (deny all IP traffic) is installed on the port for those snooping-enabled VLANs that do not have a valid IP source binding.

•This example shows displayed PVACL for a trusted port:

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

fa6/2      ip           inactive-trust-port

•This example shows displayed PVACL for a port in a VLAN not configured for DHCP snooping:

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

fa6/3      ip           inactive-no-snooping-vlan

•This example shows displayed PVACLs for a port with multiple bindings configured for an IP/MAC filtering:

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

fa6/4      ip-mac       active       10.0.0.2         aaaa.bbbb.cccc  10

fa6/4      ip-mac       active       11.0.0.1         aaaa.bbbb.cccd  11

fa6/4      ip-mac       active       deny-all         deny-all        12-20

•This example shows displayed PVACLs for a port configured for IP/MAC filtering but not for port security:

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

fa6/5      ip-mac       active       10.0.0.3         permit-all      10

fa6/5      ip-mac       active       deny-all         permit-all      11-20

Note The MAC filter shows permit-all because port security is not enabled, so the MAC filter cannot apply to the port/VLAN and is effectively disabled. Always enable port security first.

•This example shows displayed error message when issuing the show ip verify source command on a port that does not have an IP source filter mode configured:

IP Source Guard is not configured on the interface fa6/6.

You can also use the show ip verify source command to display all interfaces on the switch that have IP source guard enabled:

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

fa6/1      ip           active       10.0.0.1                         10

fa6/1      ip           active       deny-all                         11-20

fa6/2      ip           inactive-trust-port

fa6/3      ip           inactive-no-snooping-vlan

fa6/4      ip-mac       active       10.0.0.2         aaaa.bbbb.cccc  10

fa6/4      ip-mac       active       11.0.0.1         aaaa.bbbb.cccd  11

fa6/4      ip-mac       active       deny-all         deny-all        12-20

fa6/5      ip-mac       active       10.0.0.3         permit-all      10

fa6/5      ip-mac       active       deny-all         permit-all      11-20

Displaying IP Source Binding Information

You can display all IP source bindings configured on all interfaces on a switch using the
show ip source binding command.

Switch# sh ip source binding

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

00:02:B3:3F:3B:99   55.5.5.2         6522        dhcp-snooping  10    FastEthernet6/10

00:00:00:0A:00:0B   11.0.0.1         infinite    static         10    FastEthernet6/10

Switch#

Table 31-3 describes the fields in the show ip source binding command output.