Cabletron Systems SEHI-22/24, User Manual

Page: 68 / 90

Security
6-4 What is LANVIEWsecure?
Configurable violation response
Before LANVIEW S
ECURE
, any locked port which experienced a violation was
shut down automatically; now, you can choose to allow ports to remain enabled
even after an unsecured address has attempted to access a locked port. If you
choose not to disable a port which has experienced a violation, however, the
port’s only response to an intruder will be to issue a trap after the first violation;
all packets, regardless of source address, will be allowed to pass. Ports in this state
still have active eavesdropper protection (see definition below), and all packets
addressed to any destination other than the secured address(es) will be scrambled.
Full or partial security against eavesdropping
In addition to the enhanced intruder protection features described above,
LANVIEW
SECURE
provides protection against eavesdroppers by scrambling the
data portion of each packet to all ports except the port on which the destination
address has been secured — in other words, the only port that will receive the
packet in an unscrambled (readable) format is the port to which the packet was
addressed. Two levels of eavesdropper protection are provided: full security
scrambles all packets not specifically destined to the secured port, including
broadcasts and multicasts; partial security scrambles only unicast packets.
The Newest LANVIEW
SECURE
Features
Additional LANVIEW
SECURE
features available on the newest firmware versions
(SEHI 2.10.xx and higher) include:
Continuous learning mode
When configuring security on the newest LANVIEW
SECURE
devices, you can now
choose between two levels of lock status: Full lock status, which behaves as
locking has always done, and Continuous lock status, which essentially disables
intruder protection by allowing the port to continue to learn new source
addresses even when in a locked state. In this state, eavesdropper protection is
still active, and will adjust so that packets addressed to the current learned
address for a secured port are not scrambled.
TIP
If your SEHI is running firmware more recent than 1.05.01 and previous to 2.10.xx, you
will not have the ability to force a port to unsecurable status; however, for firmware
versions in that range, ports which have been forced to trunk status will not be locked, so
you can use the force trunk feature to render a port unsecurable if you wish.
NOTE
Locking ports from a Source Address window automatically provides Full lock status;
however, locking ports from the repeater- or hub-level Source Address window does not
override any existing Continuous lock status settings.