IP Source Guard (IPSG)

Principle of IP Source Guard (IPSG)

IP Source Guard (IPSG) is a security feature implemented on network switches to prevent IP address spoofing and unauthorized access. It works by validating the source IP address of incoming packets against a trusted binding table, which maps IP addresses to their corresponding MAC addresses and switch ports. If a packet’s source IP address does not match the binding table, the packet is dropped.

How IPSG Works

1. Binding Table Creation:
• The binding table is dynamically populated using DHCP Snooping or statically configured by the administrator.
• Each entry in the binding table includes:
• IP Address: The IP address assigned to a device.
• MAC Address: The MAC address of the device.
• Switch Port: The port to which the device is connected.
2. Packet Validation:
• When a packet arrives at a switch port, IPSG checks the source IP address against the binding table.
• If the source IP address matches an entry in the binding table and is associated with the correct MAC address and port, the packet is forwarded.
• If the source IP address is not found in the binding table or does not match the expected MAC address and port, the packet is dropped.
3. Dynamic Updates:
• If DHCP Snooping is enabled, the binding table is automatically updated when a device obtains or renews its IP address via DHCP.
• Static entries can be manually added for devices with static IP addresses.

Protocol Details

1. DHCP Snooping:
• IPSG relies on DHCP Snooping to dynamically build the binding table.
• DHCP Snooping listens to DHCP messages and records the IP-MAC-port mappings for devices that obtain IP addresses via DHCP.
2. ARP Inspection (Optional):
• IPSG can be combined with Dynamic ARP Inspection (DAI) to further validate ARP packets and prevent ARP spoofing.
3. Static Binding:
• For devices with static IP addresses, administrators can manually configure entries in the binding table.

Security Benefits and Attack Prevention

IPSG is designed to prevent the following types of attacks:

1. IP Spoofing:
• Attackers cannot impersonate another device by using a spoofed IP address because IPSG verifies the source IP address against the binding table.
2. Unauthorized Access:
• Devices with unauthorized IP addresses are blocked from accessing the network, as their packets are dropped by IPSG.
3. Man-in-the-Middle (MITM) Attacks:
• By ensuring that IP addresses are correctly mapped to MAC addresses and ports, IPSG reduces the risk of MITM attacks.
4. DHCP Starvation:
• IPSG works with DHCP Snooping to prevent DHCP starvation attacks, where an attacker floods the network with DHCP requests to exhaust the IP address pool.
5. Rogue DHCP Servers:
• IPSG ensures that only legitimate DHCP servers can assign IP addresses, preventing rogue DHCP servers from distributing incorrect or malicious IP configurations.

Implementation Workflow

1. Enable DHCP Snooping:
• Configure DHCP Snooping on the switch to build the binding table dynamically.
2. Enable IPSG:
• Activate IPSG on specific switch ports or globally, depending on the network requirements.
3. Configure Static Bindings (Optional):
• Add static entries to the binding table for devices with static IP addresses.
4. Monitor and Troubleshoot:
• Use switch logs and monitoring tools to verify IPSG functionality and troubleshoot any issues.

Example Use Case

In a corporate network:

• Employees use DHCP to obtain IP addresses.
• IPSG is enabled on all access ports to ensure that only authorized devices can communicate.
• An attacker attempts to spoof the IP address of a legitimate device to gain access to sensitive resources.
• IPSG detects the spoofed IP address and drops the attacker’s packets, preventing unauthorized access.

Summary

IP Source Guard (IPSG) is a critical security feature that prevents IP address spoofing and unauthorized access by validating the source IP address of incoming packets against a trusted binding table. It relies on DHCP Snooping to dynamically build the binding table and can be combined with ARP Inspection for additional security. By implementing IPSG, networks can defend against IP spoofing, MITM attacks, DHCP starvation, and rogue DHCP servers, ensuring a more secure and reliable network environment.