Question: IP Source Guard functionality

[tschafferx]

Hi Cisco community,

I have a question regarding the security of IPSG. Am I correct in the assumption that IPSG enabled with the interface command (ip verify source) and DHCP-snooping database would not prevent ARP-spoofing attacks as of the reason that these are Layer 2, and IPSG only checks IPv4 addresses entering that port (layer 3 packet). Is that correct?

I know DAI could solve the problem, but I want to know how much security IPSG provides.

Thank you in advance!

[Seb Rupik]

Hi there,

IPSG and DAI are both access-layer security features which require the DHCP snooping database to function. As you point out they operate at different layers and should be considered complementary to one another.

The security that IPSG provides comes from inspecting the DHCP snooping database and creating a PVACL on the configured switchport. This prevents a user from configuring an IP address which has not been offered/ accepted via DHCP or allowed by static IP source binding configuration on the switch.

cheers,

Seb.

[tschafferx]

Thank you for the answer. That basically confirms that IPSG does not prevent ARP-Spoofing by itself.

[PaulSmith]

Yes that's right. That is why you can still get a DHCP address while IPSG is enabled.

In regards to IPSG, the PVACL blocks IP traffic the same way a normal ACL would.