CHAPTER 6: OPERATIONAL GUIDE
OPERATIONAL GUIDE
MULTINET4 MULTI-PORT SERIAL SERVER & MANAGED SWITCH – INSTRUCTION MANUAL
6–13
6.5
Security
The following sections briefly describes the security features of Multinet4.
6.5.1
Ethernet Port Security
Multinet4 offers the ability to disable Ethernet ports upon access by an unauthorized
station. Each port may be placed in either of two different security modes: address locking
or link locking.
6.5.1.1 Address Locking
In address locking mode, a port detects an unauthorized station by comparing the source
MAC address in the frames that it receives to a list of authorized MACs. If the source MAC is
not in the authorized list the port is locked out, which effectively disables the port by
electrically isolating its PHY. Once a port is locked out it will not be re-enabled until it is
explicitly unlocked by an administrator. Lock-outs persist across resets.
When static MAC addresses have been configured on a port by an administrator those
addresses are treated as the list of authorized MACs. If no static MAC addresses are
configured, the port will "learn" the source address of the first frame it receives and treat
that MAC address as the single authorized MAC for the port. Learned authorized MACs
persist across resets.
If a static MAC is configured after a port has learned an authorized MAC, the learned MAC
is forgotten and the configured static MACs are treated as the list of authorized MACs. If all
static MACs are removed from a port, the port will learn a new authorized MAC.
6.5.1.2 Link Locking
In link locking mode a port is locked out if it loses link. Note that if a port is configured for
link locking while it is down it is not automatically locked out. It waits for the link to go up
and then down before locking out.
6.5.2
Serial Port Security
Multinet4 supports the ability to carry serial data over authenticated, encrypted TCP
connections using the SSL protocol (SSLv3 or TLSv1).
RSA public key cryptography and X.509 certificates are used to verify the authenticity of a
connecting entity. Once a connection has been established, any of a number of encryption
algorithms may be employed including DES, 3DES, AES (128 or 256 bit), or RC-4 (128 bit).
Either MD5 or SHA-1 may be used for generating message authentication codes.
6.5.2.1 Serial Data Over SSL
SSL is a cryptographic protocol that creates a secure data transfer session over a standard
TCP connection. It provides both authentication and privacy and supports a large number
of cryptographic algorithms.
