Switching · Access Security

IP Source Guard

Bind incoming IPv4 traffic to an approved endpoint location.

Independent lab examples; selected output and frame summaries are illustrative. Port naming and command support vary by switch and software release.

Network and objective

IPSG source-IP filtering on a supported Layer 2 access port with DHCP snooping. MAC-check and device-tracking variants have additional platform-specific requirements.

H1 has DHCP address 192.168.10.10 and MAC 0200.0000.0010 on SW1 Gi1/0/1 in VLAN 10. The server path on Gi1/0/24 is trusted for DHCP replies.

Physical links are solid; device roles and relevant links are labeled.

How it works

DHCP snooping learns the legitimate address binding. IP Source Guard installs an ingress filter that permits the bound source address on the correct port/VLAN and rejects unauthorized source IPv4 traffic.

With no valid binding, ordinary IPv4 traffic is blocked while the allowed DHCP exchange can establish one. This is different from DAI, which validates ARP claims; use complementary controls when both ARP and source-IP validation are required.

Static-addressed endpoints need explicit static source bindings or a supported device-tracking design. A MAC-check mode may require port security and other options depending on the platform. This example deliberately enables only source-IP filtering.

Configure or inspect

ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet1/0/24
 ip dhcp snooping trust
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 ip verify source

Verify the result

Illustrative output · selected lines

SW1#show ip verify source
Interface  Filter-type Filter-mode IP-address     Vlan
Gi1/0/1    ip          active      192.168.10.10  10
SW1#show ip source binding
MacAddress        IpAddress      Type          VLAN Interface
0200.0000.0010   192.168.10.10  dhcp-snooping 10   Gi1/0/1

The filter is active for the learned source and location. A host moved to another port cannot assume that a binding for its old port authorizes its new location.

Failure and recovery

The endpoint is changed to a static IPv4 address without a source binding. DHCP still works for other users, but this host’s ordinary IPv4 traffic is rejected.

ip source binding 0200.0000.0010 vlan 10 192.168.10.10 interface GigabitEthernet1/0/1

Key Takeaways

IPSG checks source IPv4 at ingress.
Bindings include location as well as address.
DHCP snooping is a common prerequisite.
DAI covers a different packet class.
Static endpoints need explicit planning.