Olicom CrossFire 8730, Reference Manual

Page: 116 / 234

102
CrossFire 8730 Switch Reference Guide, DOC-7047 v. 1.1 Switch Configuration
Address Filtering
The Address Filtering feature enables you to restrict certain users from
communicating with other users. To do this, you can specify source and destination
MAC-layer Token-Ring addresses to be filtered at the source port. Token-Ring
addresses can be unicast, multicast, or broadcast.
The advantage of address filtering is increased access control and network
segmentation. For example, suppose one port is connected to a server containing
confidential information from the engineering workgroup. You can prevent access
to the server by setting up filters for the addresses of connections from workgroups
other than engineering. This is an example of two “types” of filters, “allowing a
source address” (engineering) or “blocking a source address(es)” (other
workgroups). Examples of different types of filters are allowing, forcing, or
blocking packets from a source address, or allowing, forcing, or blocking packets
to a destination address. For a detailed explanation of filter types, see the
“Configure Filters Screen” section within this chapter.
Observe the following guidelines when setting up address filters:
•
Use the Filters & Port Security menu to create port filters.
•
Filters are port specific and applied to a switch’s incoming traffic only.
•
Up to 250 “filters” can be created for each switch (the filters must be applied
to specific ports at a specified switch). A “filter” is a combination of a MAC
address and the “type” of filter it is. For example, if the MAC address 0000A3
C00021 is configured as source type at a port and also configured as a
destination type, that would count as two different filters (towards the
maximum of 250 filters).
•
You can apply these filters to any combination of ports as long as there is a
maximum of 250 filters (not 250 ports, because more than one port can be part
of a filter). For example:
— Filter “A” (MAC address 0000A3 C00021, source type) can be applied to
ports 1, 5, 7, 14 (or to all the ports)
— Filter “B” (MAC address 0000A3 C00021, destination type) can be
applied to the same ports, or different ports, or once again, to all the ports
— Filter “C” (MAC address 0340B7 A02026, source type) can be applied to
any combination of ports; until a maximum of 250 filters are created.
➽
Note: If you set up a filter for broadcast packets, hosts on the other side of the
switch may not see ARP broadcast packets. To prevent this, let the switch learn the
host addresses before implementing the filter. Most hosts time out their local
address entries and attempt to relearn with a broadcast ARP.