ip source check user-bind enable

Function

The ip source check user-bind enable command enables IP packet check.

The undo ip source check user-bind enable command disables IP packet check.

By default, IP packet check is disabled.

Format

ip source check user-bind enable

undo ip source check user-bind enable

ipv4 source check user-bind enable

undo ipv4 source check user-bind enable

ipv6 source check user-bind enable

undo ipv6 source check user-bind enable

Parameters

None

Views

VLAN view, Ethernet interface view, GE interface view, XGE interface view, 25GE interface view, MultiGE interface view, 40GE interface view, 100GE interface view, Eth-Trunk interface view, port group view

Default Level

2: Configuration level

Usage Guidelines

Usage Scenario

Unauthorized users often send bogus packets with the source IP address and MAC address of authorized users to access or attack the network. Then authorized users cannot access stable and secure networks. To address this problem, you can configure IP packet check.

When IP packet check is enabled, the device checks the IP address, MAC address, VLAN information, and interface information against the binding table. You can run the ip source check user-bind check-item or ip source check user-bind check-item command to specify IP packet check items. Only packets that match the binding entries can be forwarded; otherwise, packets are discarded.

Prerequisites

The IP packet check is based by binding table. So,

The dynamic DHCP snooping binding table has been generated for DHCP users.
The static binding table has been configured manually for users using static IP addresses.
The dynamic ND snooping binding table has been generated for users dynamically obtaining IPv6 addresses through Stateless Address Autoconfiguration.

Precautions

After IP packet check is enabled using the ip source check user-bind enable command, the device checks the source IPv4 and IPv6 addresses of users' IP packets. The configuration file is displayed as follows:

 ipv4 source check user-bind enable                                                                                                 
 ipv6 source check user-bind enable

To check only IPv4 or IPv6 packets, run the ipv4 source check user-bind enable or ipv6 source check user-bind enable command.

Example

# Enable IPv4 and IPv6 packet check on GE0/0/1.

<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] ip source check user-bind enable

# Enable IPv4 packet check on GE0/0/1.

<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] ipv4 source check user-bind enable