Cabletron Systems SmartSwitch 8-slot, User'S Reference Manual

Page: 127 / 150

Chapter 9: Security Configuration Guide
SSR User Reference Manual 9 - 3
• Port-to-address lock filters
These filters prohibit a user connected to a locked port or set of ports from using an-
other port.
• Static entry filters
These filters allow or force traffic to go to a set of destination ports based on a
frame's source MAC address, destination MAC address, or both source and destina-
tion MAC addresses in flow bridging mode. Static entries are always configured and
applied at the input port.
• Secure port filters
A secure filter shuts down access to the SSR based on MAC addresses. All packets
received by a port are dropped. When combined with static entries, however, these
filters can be used to drop all received traffic but allow some frames to go through.
Configuring Layer-2 Address Filters
If you want to control access to a source or destination on a per-MAC address basis,
you can configure an address filter. Address filters are always configured and applied
to the input port. You can set address filters on the following:
• A source MAC address, which filters out any frame coming from a specific source
MAC address.
• A destination MAC address, which filters out any frame destined to specific desti-
nation MAC address.
• A flow, which filters out any frame coming from a specific source MAC address that
is also destined to a specific destination MAC address.
To configure Layer-2 address filters, enter the following commands in Configure
mode:
Configure a source MAC based address
filter.
filters add address-filter name
<name>
source-mac <MACaddr> vlan <VLAN-num> in-
port-list <port-list>
Configure a destination MAC based
address filter.
filters add address-filter name <name>
dest-mac <MACaddr> vlan <VLAN-num> in-
port-list <port-list>
Configure a Layer-2 flow address filter.
filters add address-filter name <name>
source-mac <MACaddr> dest-mac <MACaddr>
vlan <VLAN-num> in-port-list <port-list>