How to Block Unknown Devices to Access the Switch by Using IP Source Guard

T1600G-28TS , TL-SL5428E , TL-SG5428 , T1700G-28TQ , T2600G-52TS , T1500-28PCT , T2600G-28TS , T1600G-28PS , T2700G-28TQ , TL-SG5412F , T1600G-52TS , T3700G-28TQ , T1700X-16TS
Les mises à jour récentes peuvent avoir élargi l'accès aux fonctionnalités abordées dans cette FAQ. Visitez la page d'assistance de votre produit, sélectionnez la version matérielle appropriée pour votre appareil et consultez la fiche technique ou la section du micrologiciel pour connaître les dernières améliorations ajoutées à votre produit.
Introduction:
IP Source Guard is to filter the IP packets based on the IP-MAC Binding entries. Only the packets matched to the IP-MAC Binding rules can be processed, which can enhance the bandwidth utility and the network security. In some situation, customers may want to limit the unknown devices to join the existing network. We can use the IP Source Guard and IP-MAC Binding to achieve this requirement.
Application Scenario:
As shown in the picture above, we assume that the host A is a legal PC that can access the switch. And when an unknown device want to join the network, it will be blocked. This article will instruct how to achieve this requirement by using IP Source Guard and IP-MAC Binding, and here we take T3700G-28TQ as example.
Configuration Steps:
1. Designate static IP for your devices or get IP automatically from the DHCP server.
2. IP-MAC Binding
3. Enable IP Source Guard
Here are the detailed configuration steps:
Step1: you can designate static IP address for your devices or let them get IP address automatically from the front DHCP server. But in this situation, we recommend you to designate static IP address for your devices manually.
Step2: IP-MAC Binding
To enable IP Source Guard, we should create IP-MAC Binding entries first. The IP-MAC Binding function allows you to bind the IP address, MAC address, VLAN ID and the connected Port of the host together. There are three methods to create IP-MAC Binding entries: Manual Binding, ARP scanning and DHCP Snooping.
Note:
1. In this application scenario, we cannot use DHCP Snooping, because the DHCP Snooping has higher priority than IP Source Guard. That is to say, when we apply DHCP Snooping and IP Source Guard at the same time, all the devices even the untrusted ones can still get IP address from the front DHCP server and then forward packets normally.
2. If you still want to use DHCP Snooping and IP Source Guard at the same time, you need to limit the IP allocation in the front DHCP server to make sure only the legal devices can get the IP address.
We can use the Manual Binding and ARP scanning individually or simultaneously. Here we instruct the two methods respectively.
- Manual Binding
Go to Network Security-->IP-MAC Binding -->Manual Binding
As is shown in the picture, we enter the Host Name, IP Address, MAC Address, VLAN ID and choose the Protect Type as IP Source Guard and select the port the host A connects to and then click Bind to save.
2)ARP Scanning
Connect all your devices to the switch and then go to Network Security-->IP-MAC Binding --> ARP Scanning
Designate the range of the IP address and VLAN to scan, here we take 192.168.1.1~192.168.1.254 and VLAN 1 as example, you should fill the blank according to your real scenario.
After the scanning, all the devices in the range will be showed in the table, choose the entries you want to bind and select the Protect Type as IP Source Guard and then click Apply to save.
Step3: Enable IP Source Guard
Go to Network Security--> IP Source Guard
Select the ports you want to apply IP Source Guard and choose the Security Type as SIP or SIP+MAC.
Note:
1. IP Source Guard cannot be enabled for LAG members.
2. If you choose SIP, only the packets with its source IP address and port number matched to the IP-MAC binding rules can be processed; If you choose SIP+MAC, only the packets with its source IP address, port number and source MAC address matched to the IP-MAC binding rules can be processed.
Test: we can use Ping command to test the connection in the unknown devices as shown in the picture below.
Before we enable IP Source Guard:
After we enable IP Source Guard:
Est-ce que ce FAQ a été utile ?
Vos commentaires nous aideront à améliorer ce site.
Quelle est votre préoccupation avec cet article ?
- Mécontent du produit
- Trop compliqué
- Titre déroutant
- Ne s'applique pas à moi
- Trop vague
- Autre
Merci
Pour nous écrire.
Cliquer ici pour contacter le service support TP-Link.
Ce site Web utilise des cookies pour améliorer la navigation sur le site Web, analyser les activités en ligne et offrir aux utilisateurs la meilleure expérience sur notre site Web. Vous pouvez vous opposer à tout moment à l'utilisation de cookies. Vous pouvez obtenir plus d'informations dans notre politique de confidentialité .
Ce site Web utilise des cookies pour améliorer la navigation sur le site Web, analyser les activités en ligne et offrir aux utilisateurs la meilleure expérience sur notre site Web. Vous pouvez vous opposer à tout moment à l'utilisation de cookies. Vous pouvez obtenir plus d'informations dans notre politique de confidentialité .
Cookies basiques
Ces cookies sont nécessaires au fonctionnement du site Web et ne peuvent pas être désactivés dans vos systèmes.
TP-Link
SESSION, JSESSIONID, accepted_local_switcher, tp_privacy_base, tp_privacy_marketing, tp_smb-select-product_scence, tp_smb-select-product_scenceSimple, tp_smb-select-product_userChoice, tp_smb-select-product_userChoiceSimple, tp_smb-select-product_userInfo, tp_smb-select-product_userInfoSimple, tp_top-banner, tp_popup-bottom, tp_popup-center, tp_popup-right-middle, tp_popup-right-bottom, tp_productCategoryType
Youtube
id, VISITOR_INFO1_LIVE, LOGIN_INFO, SIDCC, SAPISID, APISID, SSID, SID, YSC, __Secure-1PSID, __Secure-1PAPISID, __Secure-1PSIDCC, __Secure-3PSID, __Secure-3PAPISID, __Secure-3PSIDCC, 1P_JAR, AEC, NID, OTZ
Zendesk
OptanonConsent, __cf_bm, __cfruid, _cfuvid, _help_center_session, _pendo___sg__.<container-id>, _pendo_meta.<container-id>, _pendo_visitorId.<container-id>, _zendesk_authenticated, _zendesk_cookie, _zendesk_session, _zendesk_shared_session, ajs_anonymous_id, cf_clearance
Cookies d'analyse et marketing
Les cookies d'analyse nous permettent d'analyser vos activités sur notre site Web pour améliorer et ajuster les fonctionnalités de notre site Web.
Les cookies marketing peuvent être définis via notre site Web par nos partenaires publicitaires afin de créer un profil de vos intérêts et pour vous montrer des publicités pertinentes sur d'autres sites Web.
Google Analytics & Google Tag Manager
_gid, _ga_<container-id>, _ga, _gat_gtag_<container-id>
Google Ads et DoubleClick
test_cookie, _gcl_au