UTT Technologies Chapter 8 User
Management
http://www.uttglobal.com
Page 130
8.2.1 Introduction to IP/MAC Binding
8.2.1.1 IP/MAC Binding Overview
To achieve network security management, you should perform user identification before
performing user authorization. In this section, we describe how to implement user
identification. In
Section 9.1 Firewall > Access Control
, we will describe how to control
the Applications of the LAN users in detail.
The Router provides IP/MAC binding feature to implement user identification. Using the
IP/MAC address pair as a unique user identity, you can protect the Router and your
network against IP spoofing attacks. IP spoofing attack refers to that a computer attempts
to use another trusted computer
’s IP address to connect to or pass through the Router.
The computer
’s IP address can easily be changed to a trusted address, but MAC address
cannot easily be changed as it is added to the Ethernet card at the factory.
8.2.1.2 The Operation Principle of IP/MAC Binding
For the sake of convenience, we firstly introduce several related terms including legal user,
illegal user and undefined user.
●
Legal User:
A legal user
’s IP and MAC address pair matches an IP/MAC binding
whose
Allow
check box is checked.
●
Illegal User:
An illegal user
’s IP and MAC address pair matches an IP/MAC binding
whose
Allow
check box is cleared; or the IP address or MAC address is the same as
that of an IP/MAC binding, but not both.
●
Undefined User:
An undefined user
’s IP address and MAC address both are
different from any IP/MAC binding. The undefined users are all the users except legal
and illegal users.
It allows the legal users to access the Router or access the Internet through the Router,
and denies the illegal users. And the parameter of
Allow Undefined LAN PCs
determines whether it allows the undefined users to access the Router or access the
Internet through the Router, that is, it will allow them if they
Allow Undefined LAN PCs
check box is checked, else block them.
IP/MAC binding feature can act on the packets initiated from the local computers to the
Router or outside computers. When receiving a packet initiated from LAN, the Router will
firstly determine the sender
’s identity by comparing the packet with the bindings in the
IP/MAC Binding List
, and then process the packet according to the sender
’s identity. The
details are as follows:
