What Is IP Source Guard?

IP Source Guard is a switch security feature that filters traffic on an interface based on the source IP address and, when applicable, source MAC address associated with that interface.

The goal is simple:

```

"Can this device legitimately use this source IP address?" 

If the source information does not match the switch's trusted binding information, the switch can block the traffic.

Why Is IP Source Guard Needed?

Without source validation, a device may attempt to send traffic using another device's IP address.

```

Normal:

PC-A
IP: 192.168.10.10
|
v
Switch
|
v
Network 

An attacker might attempt:

```

Attacker

Real IP:
192.168.10.50

Spoofed Source IP:
192.168.10.10 

IP Source Guard can help prevent this type of source IP spoofing on protected access interfaces.

How IP Source Guard Works

A common deployment uses DHCP Snooping to create a binding database.

             DHCP Server
                  |
                  |
             +---------+
             | Switch  |
             +---------+
               /     \
              /       \
           PC-A     PC-B
          .10        .20
```

DHCP Snooping Binding:

PC-A -> 192.168.10.10
PC-B -> 192.168.10.20

IP Source Guard validates
source information on access ports. 

When IPSG is enabled on an interface, the switch can use the binding information to determine which source IP addresses are permitted on that interface.

IP Source Guard and DHCP Snooping

DHCP Snooping is commonly used as the source of trusted IP-to-MAC binding information.

These features are often described together as DHCP Snooping-based Layer 2 security features.

Example Binding Table

Suppose DHCP Snooping has learned:

If PC-A is connected to Gi0/2, the switch can use this information when validating traffic from that interface.

Basic Cisco Configuration

First, DHCP Snooping should be configured for the relevant VLAN:

```

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10 

Configure the legitimate DHCP-facing interface as trusted when required by the topology:

```

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# ip dhcp snooping trust 

Now enable IP Source Guard on the client-facing interface:

```

Switch(config)# interface gigabitEthernet 0/2
Switch(config-if)# ip verify source 

The switch can now use its DHCP Snooping binding information to validate source IP information on that interface.

IP Source Guard with Port Security Concepts

IP Source Guard and Port Security solve different problems.

IP Source Guard Practical Example

             Switch
          +----------+
          |          |
      Gi0/2        Gi0/3
        |             |
       PC-A          PC-B
        |             |
   192.168.10.10  192.168.10.20
```

DHCP Snooping:

Gi0/2 -> 192.168.10.10
Gi0/3 -> 192.168.10.20

IP Source Guard:
Gi0/2 allows valid source information
for the binding associated with PC-A. 

If a device connected to Gi0/2 attempts to send traffic with an unauthorized source IP address, IPSG can prevent that traffic from being forwarded according to the configured validation.

How IPSG Helps Against IP Spoofing

Imagine an attacker connected to an access port:

```

Attacker's real IP:
192.168.10.50

Attacker attempts:
Source IP = 192.168.10.10

Switch checks:
Gi0/2 binding
|
v
Expected source:
192.168.10.50

Received source:
192.168.10.10

Mismatch
|
v
Traffic can be blocked 

This makes source IP spoofing more difficult on protected access-layer interfaces.

IP Source Guard Verification

Check the DHCP Snooping bindings:

```

show ip dhcp snooping binding 

Check the interface configuration:

```

show running-config interface gigabitEthernet 0/2 

Check interface information:

```

show interfaces gigabitEthernet 0/2 

Where Should IP Source Guard Be Used?

IPSG is generally most useful on untrusted, client-facing access interfaces.

Examples include:

• Employee workstation ports
• Student computer lab ports
• Office access ports
• Guest network access ports
• Other controlled endpoint-facing switch interfaces

It should not simply be enabled everywhere without understanding the topology and how legitimate source addresses are learned.

Important Consideration: Static IP Devices

DHCP Snooping-based IPSG works naturally when endpoints obtain their addresses through DHCP.

Networks containing legitimate statically configured devices need additional planning because those addresses may not appear in the DHCP Snooping binding table.

Before deploying IPSG, identify devices such as servers, printers, network appliances, and other endpoints that use static addressing and design the appropriate validation method.

IP Source Guard vs Dynamic ARP Inspection

DHCP Snooping + DAI + IP Source Guard

These three technologies can work together to create multiple layers of protection at the access layer.

             DHCP Server
                  |
                  v
         +----------------+
         |     Switch     |
         |                |
         | DHCP Snooping  |
         |      +         |
         |      |         |
         |      +-- DAI   |
         |      |         |
         |      +-- IPSG  |
         +----------------+
            /          \
           /            \
         PC-A          PC-B
    

• DHCP Snooping: Builds trusted bindings.
• DAI: Uses bindings to help validate ARP.
• IP Source Guard: Uses bindings to help validate source traffic.

Packet Tracer Lab: Configure IP Source Guard

Build this topology:

```

PC1 --------

Switch -------- Router/DHCP
/
PC2 --------/ 

Suggested lab steps:

1. Create VLAN 10.
2. Configure the client interfaces as access ports.
3. Enable DHCP Snooping for VLAN 10.
4. Configure the appropriate trusted DHCP-facing interface.
5. Allow the PCs to obtain IP addresses.
6. Verify the DHCP Snooping binding table.
7. Enable IP Source Guard on the client-facing ports.
8. Verify the configuration.

```

show ip dhcp snooping
show ip dhcp snooping binding
show running-config interface gigabitEthernet 0/2 

Quick Quiz

1. What is the main purpose of IP Source Guard?

2. Which feature commonly provides the bindings used by IPSG?

3. Which Cisco command commonly enables IP Source Guard on an interface?

4. Does IP Source Guard perform the same function as DAI?

Key Takeaways

• IP Source Guard is a Layer 2 switch security feature.
• It helps prevent unauthorized source IP addresses from being used on protected interfaces.
• DHCP Snooping commonly provides the binding information used by IPSG.
• IPSG is commonly deployed on client-facing access ports.
• ip verify source is a common Cisco configuration command.
• DAI protects ARP information, while IPSG focuses on source traffic validation.
• Static IP devices require careful planning before IPSG deployment.
• DHCP Snooping, DAI, and IPSG can work together as Layer 2 security controls.