IP SOURCE GUARD not work on EVE-NG

[dragonhunt9111]

Hello friends,

I test IP source guard on EVE-NG as below topo:

I config on switch DHCP snooping and IP source guard. then VPC get IP from DHCP server (R1) ok

But dont know why after I enable IP source guard, VPC3 can not

ping to R1 192.168.1.1

(If i remove

IP SG

command, ping is ok again)

This is showing on switch, it seems OK.

This below is my configuration on Sw:

ip dhcp snooping vlan 1
no ip dhcp snooping information option
ip dhcp snooping

interface Ethernet0/0
ip dhcp snooping trust
!
interface Ethernet0/1
ip verify source
!
interface Ethernet0/2
ip verify source

Please help me.

Thank you!!

[Martin L]

what is this name of IOS image / version and is it implemented in this virtual IOS ?

Regards, ML
**Please Rate All Helpful Responses **

[dragonhunt9111]

Hello Martin,

I use IOL in EVE-NG. This is show version of it.

Cisco IOS Software, Linux Software (I86BI_LINUXL2-ADVENTERPRISEK9-M), Version 15.2(CML_NIGHTLY_20190423)FLO_DSGS7, EARLY DEPLOYMENT DEVELOPMENT BUILD, synced to V152_6_0_81_E
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2019 by Cisco Systems, Inc.
Compiled Tue 23-Apr-19 02:38 by mmen

ROM: Bootstrap program is Linux

SW_L2 uptime is 51 minutes
System returned to ROM by reload at 0
System image file is "unix:/opt/unetlab/addons/iol/bin/i86bi_Linux-L2-Adventerprisek9-ms.SS"
Last reload reason: Unknown reason

[Martin L]

i could not verify if this image supports IP source guard; will try later today as I think I have the same image; Does CML has newer version of L2/L3 switch image?  Note "Iron " image name keyword is missing which is a must have IOL image for proper L3 switching.

Regards, ML
**Please Rate All Helpful Responses **

[paul driver]

Hello
I believe Eve-ng/Virl images dont support IPSG and  you require a EMI image (Enhanced Multilayer Software) for it to work correctly.

[Martin L · Accepted solution]

it does not work even with manual host binding

 ip source binding xyz
! example
ip source binding AABB.CC03.7000 vlan 2000 10.3.100.112 interface Fa0/0

while

ip dhcp snooping vlan 2000

snooping works fine;  IP source verify creates dynamic port ACL to filter traffic - that could be the issue. it must be virtual image incapability.

Regards, ML
**Please Rate All Helpful Responses **