IP Source Guard

[parthrawat979]

So, I am having some issue with configuring ip source guard. Here is the configuration results on SW:
Switch(config-if)#do sh ip ver so
Interface Filter-type Filter-mode IP-address Mac-address Vlan
--------- ----------- ----------- --------------- ----------------- ----
Et0/1 ip inactive-no-snooping-vlan
Et0/2 ip-mac active 10.1.1.5 00:50:79:66:68:07 1
Et0/3 ip-mac active 10.1.1.4 00:50:79:66:68:0B 1

Switch(config-if)#do sh ip dhcp sn bi
MacAddress IpAddress Lease(sec) Type VLAN Interface
------------------ --------------- ---------- ------------- ---- --------------------
00:50:79:66:68:07 10.1.1.5 86120 dhcp-snooping 1 Ethernet0/2
00:50:79:66:68:0B 10.1.1.4 86118 dhcp-snooping 1 Ethernet0/3
Total number of bindings: 2

Now the issue here is why I am unable to ping 10.1.1.4 from 10.1.1.5 or I can't even reach the ip of dhcp server(10.1.1.1) what could be possible wrong here??

[M02@rt37]

Hello @parthrawat979 

The port facing the DHCP server in trust mode ? Could you please share the port configuration ?

[parthrawat979]

Yeah, it's on trust mode for sure.

[balaji.bandi]

What switch image are you using in this lab? Do you know if we can see the interface configuration or the total show run config?

Is this your question about IP source Guard (enabled?), or are you not able to reach each other in general?

Where is your Layer 3 Gateway for this IP address? Is this switch just Layer 2 or Layer 3?

Some of the virtual images have a CEF issue, so no IP CEF on the Switch and test it.

old document but still good for understanding source guard:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_58_se/configuration/guide/2960scg/swdhcp82.html

[parthrawat979]

Some iol switch for the lab. The question is I can't ping the pcs with each other.

[M02@rt37]

@parthrawat979 

please share interface ETh0/2 and 0/3 configuration.

Thanks.

[parthrawat979]

interface Ethernet0/0
ip dhcp snooping trust

interface Ethernet0/2
switchport mode access
ip verify source
!
interface Ethernet0/3
switchport mode access
ip verify source
!

[M02@rt37]

Please try with no ip source verify command under eth0/2 and 0/3...

[parthrawat979]

Then they're pinging.

[M02@rt37 · Accepted solution]

So, IOL limitation ...  IOL is a sofware-emulated switch...Hardware forwarding features are not fully implemented and packet handling is simplified in software too !

[parthrawat979]

Yeah, it's just iol limitation. I tried it on c3750 and it worked just fine.

[Cristian Matei]

Hi,

  @parthrawat979 Try following options:

1. configure static bindings via ip source binding command, not relying on DHCP snooping database, see if it works

2. remove the above, leave the IPSG database to be populated via DHCP, and at interface level, namely ports 0/2 and 0/3, enable ip device tracking via command ip device tracking maximum X, make X to be minimum 2 to avoid weird scenarios; see if it works

3. configure static bindings via ip source binding command, not relying on DHCP snooping database, and enable ip device tracking via command ip device tracking maximum X  on ports 0/2 and 0/3; see if it works

With device tracking enabled, you should get it working.

Thanks,

Cristian.

[balaji.bandi]

Where is your Layer 3 Gateway for this IP address? Is this switch just Layer 2 or Layer 3?

Some of the virtual images have a CEF issue, so no IP CEF on the Switch and test it.

do you have answer for these ?