Differences between IPSG and port security of switches

For S series switches (except S1700 switches), both IPSG and port
security support bindings between MAC addresses and interfaces.

Their
differences are as follows:
IPSG: Binds MAC addresses to interfaces
in a binding table so that a host can only go online through a fixed
port. The hosts of which MAC addresses are not in the binding table
cannot go online through the switch. IPSG prevents IP address spoofing
attacks. For example, it prevents a malicious host from stealing an
authorized host's IP address to access or attack the network.

Port security: Converts limited number of dynamic MAC entries learned by
interfaces into secure MAC entries, so that a host can only go online
through a fixed port. The hosts of which MAC addresses are not in the
MAC address table cannot go online through the switch. Port security
prevents access of unauthorized hosts and limits the number of access
hosts. It is applicable to networks with a large number of hosts.
If
you just want to prevent hosts with unauthorized MAC addresses from
communicating with each other and a large number of hosts reside on the
network, port security is recommended.

IPSG and Port Security

Both IPSG based on a static binding table and port security support MAC and interface binding. Table 11-5 lists their differences.

If you need only to prevent hosts with unauthorized MAC addresses
from communicating with each other and a large number of hosts reside on
the network, port security is recommended.

IPSG does not fix MAC entries. Therefore, it cannot
prevent MAC address flapping caused by incorrect MAC entry updates. In Figure 11-8, when a malicious host sends data (for example, bogus ARP packets) to the switch by using an authorized host's MAC address, the switch
incorrectly updates the MAC address table. As a result, the malicious
host can intercept the packets destined for the authorized host.

Figure 11-8  Incorrect MAC address table update

To solve the MAC address flapping problem, you can configure the
device to generate snooping MAC entries based on binding tables.

For details about port security, see Port Security Configuration.

IPSG, DAI, static ARP, and port security resolve different issues and
meet different requirements. To improve network security, it is
recommended that you configure them according to your requirements.

Hi, friend!

IPSG: The binding relationship between MAC addresses and interfaces is fixed in the binding table. In this way, fixed hosts can go online only through fixed interfaces. In addition, hosts with unauthorized MAC addresses outside the binding table cannot communicate with each other through the device. Binding entries need to be manually configured. If there are a large number of hosts, the configuration workload is heavy.

Port security: A specified number of dynamic MAC addresses learned by an interface are translated into secure MAC addresses and fixed MAC addresses are used. In this way, fixed hosts can go online only through fixed interfaces and unauthorized hosts cannot communicate with each other. Secure MAC addresses are dynamically generated and do not need to be manually configured.