Ericsson EFN324, User Manual, Page: 69 / 176

Glossary
Note also that the host port does not send DHCP requests to get its IP
address. The host port IP address must be configured manually. Therefore IP
validation with dynamic IP addresses would not work. The same situation may
occur for End­users who receive their IP addresses by means other than
through DHCP. In those cases, IP validation must be configured with static IP
addresses.
8.3 Virtual MAC
Virtual MAC (VMAC) address is a security feature that replaces the End­user’s
original MAC addresses with a MAC address controlled by the system, before
forwarding the packet to the access network. A packet to the End­user has the
VMAC address as its destination within the access network, but this is
replaced, by the EFN, with the original MAC address before the packet is sent
to the End­user.
Using VMAC protects against Ethernet address spoofing. That is, when an
End­user deliberately uses another End­user’s MAC address, to trick the self­
learning Layer 2 address mechanism in the switch, in order to access
information sent to the other End­user or to hinder that End­user’s access to
the network. The VMAC also makes the Layer 2 address configuration more
fault tolerant. End­users behind different ports may be given identical MAC
addresses, without endangering correct routing within the access network.
Note: This feature can only be used if the switching rule is IP validation and
if Forced Forwarding is activated by specifying an uplink. A gateway
can optionally also be specified.
A MAC address consists of 48 bits or 6 octets. The separator sign is usually a
colon (“:”). A virtual MAC address is an extended use of the IEEE specification
for the local MAC address format.
The VMAC format is depends on whether the EFN324 is a stand­alone
(managed only by PEM) or an embedded (managed by an ECN) Ethernet
access switch. These are described separately in the following subsections.
8.3.1 VMAC for a Stand­alone EFN324
The VMAC address that the system allocates to each End­user is based on
the End­user port number, switching domain ID and EFN324 identity.