IP source guard

[sivam siva]

Hi

cisco press CCNP book says below lines for ip source guard, where i have doubt in that

"The source MAC address must be identical to the MAC address learned on the
switch port and by DHCP snooping. Port security is used to filter traffic."

when packet comes to the switch it checks the source mac of packet by comparing with the learned mac which is  through dhcp snooping or ip device tracking or static entry.

Please anyone tell me what is the use of port security here ? how its filter the traffic by coordinate with source guard ? 

Thanks in advance

[mkazam001]

IPSG is configured at the access layer and uses the DHCP Snooping database, or static IP binding entries, to dynamically create ACLs on a per-port basis (these can’t be viewed in the running-configuration). Any traffic which doesn’t match the binding entries is dropped in hardware. However, the port won’t go into the errdisable state – it won’t even display a violation message at the console.

With port security you can configure number of device macs allowed on port as well as an action - eg, shutdown the port.

regards, mk

[paul driver]

Hello

Just like to add that IPSG  can be used at a layer 2 or layer 3 perspective, you can configure it to validate on ip address or ip address and mac-address..

Having IPSG check just on the ip address will validate the interface ip address of the host and any change to this hosts mac-address will not be verified against the dhcp binding table or any static bindings

int x/x
ip verify source

Having IPSG check on the ip and mac address will validate the interface ip address of the host and the mac address in dhcp binding table (or static bindings) thus any change to either ip or mac will cause a IPSG violation 
int x/x
ip verify source port-security
switchport port-security

[sivam siva]

Hello @paul driver @mkazam001

Thanks for your reply

My question is what is the use of configuring port security with IPSG

IPSG can check the source Mac address against the DHCP snooping binding table, like checking source IP right?
What is the idea behind it how it's plays filtering roles with IPSG?

[paul driver]

Hello

ipsg by default helps spoofing of an hosts IP address but you can also enable it as stated to check the validity of the learned mac address via dhcp snooping or static filtering

My understanding the port-security of IPSG enables this mac- address filtering