IP source guard [Документация VAS Experts]
Документация VAS Experts Документация VAS Experts-mobile
in

Settings

  • Show page
  • Old revisions
  • Export to PDF
  • Backlinks
  • Show page
  • Old revisions
  • Export to PDF
  • Backlinks

    • Differences

    This shows you the differences between two versions of the page.

    Link to this comparison view

    Both sides previous revisionPrevious revision
    Next revision    		Previous revision
    en:dpi:bras_bng:bras_l2_options:bras_l2_vlan_ipsg:start [2023/10/13 13:50] – ↷ Page moved from en:dpi:bras_bng:opt_bras_l2:bras_l2_options:bras_l2_vlan_ipsg:start to en:dpi:bras_bng:bras_l2_options:bras_l2_vlan_ipsg:start elena.krasnobryzhen:dpi:bras_bng:bras_l2_options:bras_l2_vlan_ipsg:start [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1
    Line 1: Line 1:
    -====== IP source guard ====== 
    -{{indexmenu_n>1}} 
    -FastDPI BRAS allows you to control the correspondence of VLAN tags and IP addresses for subscribers. 
    -When assigning IP addresses using DHCP the fastDPI BRAS stores VLAN/QinQ subscriber tags in its [[en:dpi:dpi_components:platform:dpi_admin:admin_db:start#Activating the built-in database|UDR]] database and 
    -and then uses this data to control whether the source IP address and VLAN tag match. 
    - 
    -To enable IP source guard mode you should set the value of ''bras_ip_source_guard'' option in the fastdpi.conf: 
    -  * 0 – IP source guard is disabled. It is the default value. 
    -  * 1 – IP source guard is enabled and is only applicable to active sessions. If the session resides in ''unknown'' state (after the fastDPI is restarted), then the IP source guard will not be used,so a packet will be forwarded. 
    -  * 2 – strict: IP source guard is enabled and is applicable to sessions resided in ''active'' and ''unknown'' states. In this case VLAN tags stored in the UDR are used  for sessions that resides in ''unknown'' state. 
    - 
    -The packet will be forwarded in the following cases: 
    -  * ''bras_ip_source_guard=1'': conditions are met 
    -    * Session is active and packet VLAN tags are the same as registered in DHCP request ones 
    -    * Session state is unknown 
    -  * ''bras_ip_source_guard=2'' (strict): 
    -    * Session is active and VLAN tags are the same as registered in DHCP request ones 
    -    * Session state is unknown and VLAN tags are the same as stored in the UDR 
    - 
    -If the conditions are not met the package will be dropped. 
    - 
    -IP source guard is used just in case of outbound traffic (from LAN to WAN). 
    - 
    -Stingray Service Gateway 7.4+: the [[en:dpi:bras_bng:bras_l2_vlan_term:bras_l2_vlan_term_as|AS termination]] mode is added. The IP source guard is used only to those source IPs, where AS is marked as '' term ''.