ip source check user-bind enable
Function
The ip source check user-bind enable command enables IP packet check.
The undo ip source check user-bind enable command disables IP packet check.
By default, IP packet check is disabled.
Views
GE interface view, XGE interface view, 40GE interface view, port group view, Eth-Trunk interface view, VLAN view
Usage Guidelines
Usage Scenario
Unauthorized users often send bogus packets with the source IP address and MAC address of authorized users to access or attack the network. Then authorized users cannot access stable and secure networks. To address this problem, you can configure IP packet check.
When IP packet check is enabled, the device checks the IP address, MAC address, VLAN information, and interface information against the binding table. You can run the ip source check user-bind check-item (interface view) or ip source check user-bind check-item (VLAN view) command to specify IP packet check items. Only packets that match the binding entries can be forwarded; otherwise, packets are discarded.
Prerequisites
- The dynamic DHCP snooping binding table has been generated for DHCP users.
- The static binding table has been configured manually for users using static IP addresses.
Precautions
The ip source check user-bind enable command and the aggregate-vlan command cannot be used simultaneously.
