Upon detecting that packets with a specific MAC address are aggressive, users can set a
blackhole MAC address entry to filter out packets with this MAC address and defend against
attacks.
MAC Address Table Lookup
To improve interface security, switch modules support MAC address table lookup based on
VLAN IDs and MAC addresses. The network administrator can add static entries to the MAC
address table. A static entry defines the mapping between a MAC address and an interface. In
this way, devices with specific MAC addresses are bound to interfaces, defending switch
modules against attacks from packets with forged MAC addresses.
Port Isolation
Port isolation prevents ports on the same switch module from transferring Layer 2 packets
between each other. A switch module supports unidirectional and bidirectional port isolation.
Port isolation ensures user network safety, helps construct cost-effective and intelligent
community networks, effectively controls unnecessary broadcast packets, and increases the
network throughput.
Packet Filtering
Packet filtering is used to filter out invalid or unwanted packets.
Switch modules can filter out packets based on user-defined rules. For example, switch
modules check whether the MAC address, IP address, port number, and VLAN ID of a packet
comply with the rules. Packet filtering does not check the session status or analyze data. This
method effectively controls the packets that pass through switch modules.
2.7.3 Management Module
This section describes the hierarchical command protection, remote SSH logins, and SNMP
encrypted authentication of management modules.
Hierarchical Command Protection
Management modules authenticate users when they are logging in to management modules
over an Ethernet port. Only authenticated users can configure and maintain management
modules.
Management modules use a hierarchical protection mode for commands, and define three
command levels in ascending order: monitoring level, configuration level, and management
level. Users are also classified into three levels accordingly: common users, operators, and
administrators. Users can use only commands at levels the same as or lower than their own
levels, effectively controlling user rights.
Remote SSH Login
Management modules support SSH. On networks without security assurance, SSH provides
security guarantee and authentication functions for user logins and defends against multiple
attacks. Management modules also support SFTP to provide encryption protection for file
transfer.
SNMP Encrypted Authentication
Management modules support encrypted authentication over SNMPv3 and SNMP Trap V3.
When management modules are managed by the NMS over SNMP, the encrypted
E9000 Server
User Guide
2 Overview
Issue 25 (2019-11-30)
Copyright © Huawei Technologies Co., Ltd.
37
