ZyXEL Communications IES-1248-51A, User Manual

Page: 274 / 654

Chapter 38 IP Bridge
IES-1248-51V User’s Guide
274
The IP-aware IES-1248-51V does not modify the IP packet header, but it uses the
destination IP address to modify the layer-2 header, in particular the source MAC
address, destination MAC address, and VLAN tag. As a result, the IES-1248-51V
prevents the MAC addresses and VLAN ID downstream of the IES-1248-51V (in
other words, the subscribers’ MAC addresses and VLAN ID) from propagating into
the network upstream of the IES-1248-51V, and vice versa.
In the end, the IP-aware IES-1248-51V makes the network more secure and more
scalable, as explained below.
• User-to-user security. The IES-1248-51V does not forward subscribers’ MAC
addresses upstream of the IES-1248-51V, so there is no way for subscribers to
know each other’s MAC addresses. This prevents the spoofing of MAC addresses
and IP addresses upstream of the IES-1248-51V.
• Scalability. The scale of access networks is typically limited by the number of
MAC addresses in the network. Since the IES-1248-51V does not forward
subscribers’ MAC addresses or VLAN ID upstream, the upstream network is
more scalable, and it is simpler to use the same VLAN ID upstream of several
IES-1248-51V. In addition, the IES-1248-51V drastically reduces the scale of
ARP traffic storms.
The IES-1248-51V itself is transparent in the network.
38.1.1 Upstream and Downstream Traffic
When the IES-1248-51V forwards upstream traffic, it makes the following changes
in the layer-2 header.
The original frame has the IES-1248-51V’s MAC address as the destination MAC
address because the IES-1248-51V, not the device that really has the destination
IP, responded to the ARP request for the destination IP. (This is part of the ARP
proxy feature for IP bridges.) Once the IES-1248-51V receives the frame, it
updates the MAC addresses and VLAN ID and forwards it to the device that really
has the destination IP.
Table 85 IP Bridge: Layer-2 Header for Upstream Traffic
ORIGINAL UPDATED
Source MAC address Subscriber’s MAC address IES-1248-51V’s MAC address
Destination MAC address IES-1248-51V’s MAC address Destination IP’s MAC address
VLAN ID Subscriber’s VLAN ID Destination IP’s VLAN ID