TechKnowSurge
Cisco CCNA 5.7
TechKnowSurge Catalog Videos DEMO: IP Source Guard (IPSG)
VideoNetworkFree

DEMO: IP Source Guard (IPSG)

IP Source Guard is configured on Cisco switches using DHCP snooping as the binding database or manually defined static IP-to-MAC bindings, with a single interface-level command enabling traffic verification.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

IP Source Guard is a Layer 2 security feature on Cisco switches that prevents IP spoofing by validating the source IP address of traffic entering an untrusted port against a known binding database. Its configuration follows a pattern similar to Dynamic ARP Inspection, relying on the same DHCP snooping infrastructure to populate binding information dynamically. To enable dynamic operation, DHCP snooping must be activated globally and assigned to the relevant VLAN, after which the ip verify source command is applied at the interface level to enforce address validation on that port. For scenarios where DHCP is not in use or where tighter administrative control is required, IP Source Guard also supports static bindings. A static entry is created by associating a specific MAC address with a VLAN, IP address, and physical interface using the ip source binding command, effectively whitelisting a known host without relying on DHCP lease data. Whether using dynamic or static bindings, the enforcement mechanism remains the same: any IP packet arriving on the configured interface with a source address not present in the binding table is dropped, significantly reducing the risk of address spoofing attacks within the network.

What you'll learn

What's covered

IP Source Guard Config

Aligned to

Cisco CCNA
5.7 Configure and verify Layer 2 security features

Key terms

Dynamic Host Configuration Protocol
DHCP
A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
IP Source Guard
A Layer 2 security feature on switches that filters traffic by validating source IP and MAC addresses against the DHCP snooping binding database to prevent IP and MAC address spoofing.
DHCP Snooping
A switch security feature that classifies ports as trusted (connected to legitimate DHCP servers) or untrusted (connected to end devices) and drops DHCP server responses received on untrusted ports. It builds a binding database of valid IP-to-MAC-to-port mappings used by other Layer 2 security features like Dynamic ARP Inspection.
IP Source Binding
A manually configured static entry on a Cisco switch that maps a MAC address, VLAN, and IP address to a specific interface for use with IP Source Guard.

Topics

Ip Source Guard Dhcp Snooping Cisco Switching Network Security Layer 2 Security Networking

Transcript

Configuring IP Source Guard

Let's take a look at some of the configurations for IP Source Guard. Not much of a surprise that it's very similar to how we set up something like dynamic ARP inspection. What I'm going to do is jump on switch 2 here and just show you how to configure some of this.

What we're going to do is I'm going to set up DHCP binding. I can actually statically set up my different bindings, but since I want this to be dynamic, I'm going to set up DHCP snooping.

So what I'm going to do is I'm going to get into the global configuration mode, configure ip dhcp snooping, and then we will do snooping for VLAN, and let's do one of our other VLANs, so we're going to do it for VLAN 30.

Then I'm going to get into the interface, so I'm going to do an interface, I'll just do a random one here, we'll say fa, how about 0 3, and hit enter on that. And then I'm going to say ip verify source. That's really the only command that we need to enable this from IP Source Guard on the switch. So I'm going to hit enter, and now I have it configured, so it's going to verify the IP addresses.

Static bindings

Now it's going to verify it based off of either the DHCP snooping database, the binding database, or what I can do is I can set up a static, so I can do an ip source binding. I actually got it copied over here because there's quite a bit to it.

What I'm doing is I'm binding the MAC address with the VLAN, and so maybe I'd bind that to VLAN 30, let's bind it to VLAN 30, with the IP address, maybe it's a machine on here, so we're going to do 10.1.30.34, and interface, and let's say zero three, so we'll do zero three. And then that's how to set up a static binding on it.

So just a few commands to set this up, to verify the IP address.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →