Why does IPSG fail to take effect

21

The possible causes are as follows:

--Invalid binding entries
A static binding table is created using the user-bind static command. A dynamic binding table is generated only after the DHCP snooping function is enabled.

--IPSG not enabled on the specified interface or VLAN
After a binding table is generated, the IPSG function must be enabled in the interface or VLAN view using the ip source check user-bind enable command.
IPSG takes effect only on the interface or VLAN where it is enabled, and IPSG check is not performed on the interfaces or VALNs without IPSG enabled. Therefore, if IPSG does not take effect on an interface or in a VLAN, the IPSG function may not be enabled on this interface or in this VLAN.

--Insufficient hardware ACL resources
The hardware ACL resources are shared by IPSG and other services. If the ACL resources are insufficient, IPSG cannot take effect.
For example, you can run the display dhcp static user-bind all verbose command to view the IPSG status corresponding to static binding entries. If the value of IPSG Status is ineffective, IPSG of this entry does not take effect. The possible reason is that hardware ACL resources are insufficient.

--Conflict between IPSG and QoS traffic policy
This situation may only occur in V1R6C05. When a QoS traffic policy conflicts with IPSG, the traffic behavior in the QoS traffic policy takes effect.

Other related questions:
IPSG does not take effect on an S series switch. What are the possible causes
If IPSG does not take effect on an S series switch (except the S1700), possible causes include the following: 1. A binding entry is incorrect. a. A static binding table is created using the user-bind static command. If the binding entry of a valid host is not in the binding table, add the host's binding entry to the binding table. If the host's entry exists in the binding table, check whether the MAC address in the entry is the same as the host's MAC address. If the network card of the host is replaced, the MAC address in the entry may not be updated. Check whether the host's entry contains VLAN information. Only when the interface connected to this host has been added to the correct VLAN, the switch allows the packets from the host to pass. b. A dynamic binding table is generated only when DHCP snooping is enabled, the interface connected to the DHCP server is configured as a trusted interface, and then the PC obtains a new IP address. 2. IPSG is not enabled in the specified interface or VLAN view. After a binding table is generated, the IPSG function must be enabled in the interface or VLAN view using the ip source check user-bind enable command. IPSG takes effect only on the interface or VLAN where it is enabled, and IPSG check is not performed on the interfaces or VLANs with IPSG disabled. Therefore, if IPSG does not take effect on an interface or in a VLAN, the IPSG function may not be enabled on this interface or in this VLAN. 3. IPSG is enabled in the VLAN to which the uplink interface belongs. IPSG is enabled on the user-side interface, namely, the downlink interface. If IPSG is enabled on the uplink interface, the packets returned by the gateway may be discarded. As a result, user service is interrupted. Solution: Disable IPSG in the VLAN to which the uplink interface belongs. 4. DHCP snooping is disabled or a DHCP snooping trusted interface is configured on the uplink interface or in the VLAN to which the uplink interface belongs. If DHCP snooping if disabled on an interface using the dhcp snooping disable command, or if a DHCP snooping trusted interface is configured on the interface using the dhcp snooping trusted command, the IPSG function on the interface or in the VLAN to which the interface belongs does not take effect. 5. Hardware ACL resources are insufficient. The hardware ACL resources are used by IPSG and other services. If the ACL resources are insufficient, IPSG cannot take effect. For example, you can run the display dhcp static user-bind all verbose command to view the IPSG status corresponding to static binding entries. If the value of IPSG Status is ineffective, IPSG of this entry does not take effect. The possible cause is that hardware ACL resources are insufficient. 6. A QoS traffic policy conflicts with IPSG. This situation may only occur in V1R6C05. When a QoS traffic policy conflicts with IPSG, the traffic behavior in the QoS traffic policy takes effect. In this situation, you need to modify service configurations.

Types of packets checked by S series switches with IPSG enabled
For S series switches (except S1700 switches), IPSG takes effect only for IP packets (except DHCP packets) but not for packets of other types such as ARP or PPPoE. With IPSG enabled, an S series switch checks only IPv4 packets in versions earlier than V200R001 and checks all IPv4 and IPv6 packets in V200R001 and later versions.

Why the MAC-VLAN does not take effect
MAC address-based VLANs take effect only to untagged packets. If an MAC address-based VLAN does not take effect, check whether the incoming packets contain VLAN tags.

Why a traffic policy does not take effect on an AR
Pay attention to the following points when configuring a traffic policy so that the traffic policy can take effect: - In a traffic behavior, when the permit action is configured with other actions, the device performs these actions one by one. The deny action cannot be used with other actions (except traffic statistics and traffic mirroring); even if they are configured together, only the deny action takes effect. - When packets are filtered based on an ACL rule, if the rule is configured to permit, the action taken on the packets is decided by the deny or permit action configured in the traffic behavior. If the rule is configured to deny, packets are discarded no matter whether the deny or permit action is configured in the traffic behavior. - A traffic policy that contains the following traffic behaviors can be applied only in the outbound direction of a WAN interface: traffic shaping, adaptive traffic shaping, congestion management, and congestion avoidance. - After fragmentation is configured on an AR, if the rule of the traffic classifier contains the non-first-fragment field, the rate limiting or statistics collection function cannot be configured for the fragmented packets sent to the AR. - If a traffic behavior is bound to an ACL that has no rule configured, the traffic policy referencing the ACL does not take effect.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top