IP Source Guard (IPSG)

This topic is to discuss the following lesson:

I configured the switch port for voice and data vlans. I was trying to use IP source guard for this port but it was failing. I can see the phone IP address in the DHCP binding table but the IP source guard was failing. I configured static binding for the IP phone and it was working.
Any suggestion to solve this issue without using the static binding ?

Hello Hind

In order for IP source guard to function with a voice VLAN, DHCP snooping must be enabled on that voice VLAN. Take a look at the following documentation from Cisco:

When you say IP Source Guard was failing, what do you mean exactly? If the issue was not DHCP snooping, please elaborate on the behaviour you are encountering and come back and let us know so we can continue troubleshooting.

I hope this has been helpful!

Laz

Does this work on GNS? I tried this on GNS3 with an IOU image, though the configuration was perfect, I couldn’t ping between clients.

Hello Dongsok

When some features tend to work on some platforms and not others, there may always be an issue with the IOS, the platform being used, or just the fact that GNS3 may not be able to accurately reproduce the features. It’s difficult to determine this, unless you have real devices on which you can configure these features. Hopefully, after reviewing your config as well, you’ll be able to determine the reason for the topology not functioning correctly.

I hope this has been helpful!

Laz

Hi Laz,

When the voip phone comes up it will boot as vlan 10 (data vlan). the port is configured to authenticate via ISE server. ISE will notice the mac address is for VOIP phone and will change the vlan from vlan 10 (data vlan) to vlan 20 (voice vlan).
VOIP phones configured to use dhcp to get the IP address. I am able to see the voip ip address in the dhcp sooping binding but the phone ip address is no longer pingable.
I think IP source guard feature blocking the VOIP phone as its using 2 vlans for same MAC address.
Any idea how to fix this issue ?

Hello Dongsok,
in GNS3 you can test IPSG only with checking IP address. It does not work while you wanna check the source MAC address.

I tested this with VIRL vios_l2-adventerprisek9-m.03.2017.qcow2 image.

2 Likes

Hello Michal,
Thank you, I’ll definitely try that out.

Laz, Thx for the comment and suggestion!

1 Like

Hello Hind

When using ISE and voice and data VLANs on the same interface, there are some additional precautions that you should take. Specifically, these can be found at this Cisco Documentation.

Look especially at steps 5 through 7 in the procedure described.

To be honest, I haven’t configured voice and data VLANs along with authentication with ISE and IP source guard with an IP telephony implementation, but I’m hoping this may be helpful for you…

Laz