Configuring IP Packet Check

IPSG can check IP packets based on VLANs or interfaces (including NVE interfaces).

The CE12800E does not support IP packet check on NVE interfaces.

If IP packet check is configured on an interface and in a VLAN, check items configured on the interface take effect.

Procedure

• In the VLAN:
  1. Run system-view

     The system view is displayed.

  2. Run vlan vlan-id

     The VLAN view is displayed.

  3. Run ip source check user-bind enable

     IP packet check is enabled.

     By default, IP packet check is disabled in the VLAN.

  4. Run ip source check user-bind check-item { ip-address | mac-address | interface }^*

     IP packet check items are configured.

     By default, the device checks the source IP address, source MAC address, VLAN ID, and interface number in IP packets in the VLAN view.

     This command is valid only for dynamic binding entries. IPSG enables the device to check all the static binding entries.

  5. Run commit

     The configuration is committed.

• On the interface:
  1. Run system-view

     The system view is displayed.

  2. Run interface interface-type interface-number

     The interface view is displayed.

  3. Run ip source check user-bind enable

     IP packet check is enabled.

     By default, IP packet check is disabled on the interface.

  4. Run ip source check user-bind check-item { ip-address | mac-address | vlan }^*

     IP packet check items are configured.

     By default, the device checks the source IP address, source MAC address, VLAN ID, and interface number in IP packets in the interface view.

     This command is valid only for dynamic binding entries. IPSG enables the device to check all the static binding entries.

  5. Run commit

     The configuration is committed.

• on the NVE interface
  1. Run system-view

     The system view is displayed.

  2. Run interface nve nve-number

     The NVE interface view is displayed.

  3. Run ip source check user-bind peer-ip peer-ip enable

     IP source guard is enabled for the NVE interface.

     By default, IP source guard is disabled on an NVE interface.

  4. Run commit

     The configuration is committed.