Additional Features
Ethernet Security
200R204-000
Innovx FastSwitch Ethernet Switch
5-9
Issue 2
Installation and Operation Manual
MAC-based Security Mode
On a port configured for MAC-based security, each port is configured with up to eight legal MAC
addresses. Any MAC address detected on a port that is not on that port’s legal list will be considered
an illegal MAC address. If the FastSwitch detects an illegal MAC address for a particular port, the
port will be instantanously disabled according to the configured security option:
•
Timed Option
Disables the port for a timeout period of five minutes, after which time the port is automatically
enabled. If a power cycle occurs after a port disable, the port will come up disabled and then
becom re-enabled after the 5-minute timeout.
•
Permanent Option
Disables the port permanently until manually re-enabled by an authorized administrator. If a
power cycle occurs after a port disable, the port will come up disabled.
•
Filtered Option
Illegal MAC address is added to the address resolution lookup (ARL) table. FastSwitch filters
out packets destined to that address, causing the hacker to lose connectivity to the network.
Legal MAC frames will be forwarded without interruption, since the port is not disabled.
Note
The Filtered option causes FastSwitch to block the workstations with illegal addresses from receiving data.
The Timed or Permanent options cause FastSwitch to disable the port with an illegal MAC address, thereby
blocking attached workstations from receiving and transmitting data.
Note
If the uplink port is connected to an ethernet backbone with many MAC addresses, it is recommended to
configure that port for Port-based, rather than MAC-based protection.
Note
The use of external hubs in the network compromises ethernet security. It is recommended that another
FastSwitch unit be used in place of external hubs whenever possible.
1. Log into the FastSwitch as an administrator.
2. Connect a legal host (or legal hosts through a hub) to a FastSwitch port.
3. Check the MAC addresses at the port by typing:
show arl-cache
4. Configure the port for MAC-based mode by typing:
configure security mac-based port
[n]
5. Set the port for the desired disconnect protection option by typing:
configure security
[timed or permanent or filtered]
port
[n]
6. FastSwitch can automatically learn legal MAC addresses from a group of hosts at a port by
taking a ‘snapshot’ of MAC addresses as the hosts send packets. To activate the snapshot, type:
configure security mac-addr snapshot port
[n]
7. Enable the port to transmit and receive by typing:
configure ports enable port
[n]
8. To prevent hacks into an unused ports, disable the port by typing:
configure ports disable port
[n]
Note
Type
show security
to check the configured security settings for all ports.
Summary of Contents for FastSwitch
Page 61: ......
