Fore Systems forerunner series, Configuration Manual

Page: 107 / 352

ForeRunner ATM Switch Network Configuration Manual
3 - 21
Con
figurin
g an
Em
ul
ated
LAN
Configuring an Emulated LAN
3.5 ELAN Access Control
Basic ATM Forum LAN Emulation Servers do not guard against unauthorized users learning
an ELAN’s LES address and then joining the ELAN. However, a method of authorization
checking is available in ForeThought 5.2.x. After a LEC obtains the address of its LES, the LEC
sends a request to the LES to join the ELAN. If the LES has ELAN access control enabled, it
sends a message to the LECS to verify that the LEC is allowed to join. If verification is received
from the LECS, then the LES gives the LEC permission to join. If verification is not received
from the LECS, the LES rejects the join request and the LEC is dropped.
Using this feature, an authorization check is also performed each time the LECS reloads the
LECS configuration file. (The LECS periodically checks whether its configuration file has been
modified, and, if it has, the file is re-read. The length of this period, in seconds, is defined by
the
Reload_Period
key.) If the file has changed to disallow some clients that were previ-
ously allowed, those clients will be dropped from the ELAN.
NOTE
ELAN access control also works with a third-
party LECS. The LES revalidates the client every
600 seconds since the third-party LECS will not
contact the LES with configuration changes.
You can enable ELAN access control when you are creating the LES. When you use the
conf
lane les new
command, specify the
-secure
option. This indicates you want to activate a
secure LES/BUS pair. (ELAN access control is disabled by default.)
myswitch::configuration lane les> new < LES Selector Byte (HEX) > < LES name >\
[-bus < BUS Selector Byte (HEX) >]\
[-type (ethernet | token-ring)] \
[-mtu (1516 | 1580 | 4544 | 9234 | 18190)] \
[-secure wka | < LECS ATM Address >] \
[-registertlvs (enable | disable)] \
[-anycast < LES Anycast ATM Address >]
[-peers < atm-addr > ...]
If you enter
wka
with the
-secure
option, the ATM Forum well-known LECS address is
used. In this case, you do not have to type the actual well-known address. However, if you are
using an LECS address that is different than the well-known address, then you must type the
full LECS ATM address to be used.
If you want to disable ELAN access control, or if you want to enable ELAN access control at a
later time after the LES has been created, you can use the
conf lane les security
com-
mand to do this. See the AMI Configuration Commands Reference Manual for more information
about this command. By using this command, you do not have to delete and recreate the LES.