PlantUML DiagramIP Source Guard Enforcement
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
IP spoofing — sending packets with a false source IP — is the foundation of many attacks. A SYN flood uses spoofed sources so the attacker can't be traced. A DNS amplification attack spoofs the victim's IP to reflect traffic at them. An attacker inside the network spoofs another host's IP to bypass ACLs. IP Source Guard stops all of this at the access port.
IP Source Guard uses the same DHCP snooping binding table that DAI uses. When a packet arrives on an untrusted port, IP Source Guard checks the source IP and MAC against the binding table entry for that port. If they don't match — the packet is dropped. This prevents a host from sending traffic with a source IP it doesn't legitimately own.
IP Source Guard is port-based and per-VLAN. It creates an implicit Port ACL (PACL) on each untrusted port. Because it's implemented as a hardware ACL, it has no performance impact on modern switches. The overhead is purely in configuration management — every static host needs a binding entry.
! Prerequisite — DHCP snooping on the VLANSW1(config)# ip dhcp snoopingSW1(config)# ip dhcp snooping vlan 10,20! Enable IP Source Guard on untrusted access portsSW1(config)# interface range gigabitEthernet0/1 - 23SW1(config-if-range)# ip verify sourceSW1(config-if-range)# exit! For ports with static hosts — add bindingsSW1(config)# ip source binding 0050.7966.6800 vlan 10 10.10.10.50 interface gigabitEthernet0/5! To verify the MAC too (not just the IP):SW1(config-if-range)# ip verify source port-security! VerifySW1# show ip verify sourceSW1# show ip source binding
The `ip verify source` command enables IP Source Guard using IP-only checking. Adding `port-security` extends the check to the source MAC as well — the more thorough option. For a port with static hosts, you must add explicit `ip source binding` entries or IP Source Guard drops the traffic.
| Feature | Protects against | Depends on |
|---|---|---|
| Port Security | MAC flooding, spoofing, rogue switches | None |
| DHCP Snooping | Rogue DHCP servers, starvation | None |
| Dynamic ARP Inspection | ARP spoofing / MitM | DHCP snooping binding table |
| IP Source Guard | IP spoofing | DHCP snooping binding table |
These four features layer on top of each other. Port Security is the foundation — it stops the crudest attacks. DHCP Snooping adds the binding table, which DAI and IP Source Guard use. Configure all four on every access port in a production enterprise network — they're the standard Layer 2 security stack.
You're securing a corporate access switch with 24 user-facing ports and one uplink to distribution. What Layer 2 security stack should you configure?
Select the safest next action.
Layer 2 security is mostly about eliminating trust. Every access port is potentially hostile; every client could be an attacker. The four features — port security, DHCP snooping, DAI, IP Source Guard — close the most common attack vectors. They cost nothing in performance and few hours to configure. Do it. Section 15 complete — Section 16 covers ACLs and wireless security in depth.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.