topic Re: IP Source Guard in Network Security

IP Source Guard

muos — Fri, 13 Jan 2023 22:03:51 GMT

I'm trying to enable IP Source Guard on an old ws-c2960-24tt-l iso 15.0(2)SE4

In EXEC mode

int f0/x

I've tried both commands both error at verify, sadly... Any pointer?

ip verify source

ip verify source port-security

Re: IP Source Guard

balaji.bandi — Fri, 13 Jan 2023 22:12:40 GMT

post output :

show version

show License

Re: IP Source Guard

MHM Cisco World — Fri, 13 Jan 2023 22:16:21 GMT

if the command not accept then this feature is not work in this platform.

Re: IP Source Guard

muos — Sat, 14 Jan 2023 08:47:21 GMT

Thank you for your responses. Trying to learn Cisco and would like to mitigate IP address spoofing. What other configuration do you suggest, given that IP Source Guard is unavailable to me?

I would appreciate any advice you can give me.

Re: IP Source Guard

Marius Gunnerud — Sat, 14 Jan 2023 09:21:38 GMT

If this command is not available then you are most likely either missing the security license or running LAN LITE image. Verify which IOS image you are using on the switch and the license features installed.

You could also look into DHCP snooping and ARP inspection.

Re: IP Source Guard

muos — Sat, 14 Jan 2023 11:19:29 GMT

Marius, I'm using a packet tracer, so not sure how the license works. I've enabled DHCP snooping, and ARP inspection does that act as protection for IP address spooning as well?

Re: IP Source Guard

Marius Gunnerud — Sat, 14 Jan 2023 11:25:32 GMT

Yes they help with protecting against IP address spoofing as they create a database of IP to MAC associations. IP Source Guard also uses these tables for its mapping.