MNS-BB
Software User Guide
-32-
7.0
Using Authorized IP Managers to Protect Against Unauthorized Access
7.1
Authorized IP Manager Features
This feature enables you to enhance security on the switch by using IP addresses to authorize which
stations (PCs or workstations) can access the switch. Thus, having the correct passwords is not
sufficient for accessing the switch through the network unless the station attempting access is also
included in the switch’s Authorized IP Managers configuration. Access controls cover:
Telnet (CLI )
SNMP (network management)
Web (Web Interface)
Up to 25 authorized manager addresses, where each address applies to either a single management
station or a group of stations
Note
This feature does not protect access to the switch through a modem or direct connection to the
Console (RS-232) port. Also, if the IP address assigned to an authorized management station is
configured in another station, the other station can gain management access to the switch even though
a duplicate IP address condition exists. For these reasons, you should enhance your network’s
security by keeping physical access to the switch restricted to authorized personnel, using the
password features built into the switch, and preventing unauthorized access to data on your
management stations.
7.2 Access
Levels
For each authorized manager address, you can configure either of these access levels:
7.2.1
Authorizing Single Stations:
The table entry authorizes a single management station to have IP access to the switch. To use this
method, just enter the IP address of an authorized management station in the Authorized Manager IP
column, and leave the IP Mask set to
255.255.255.255
. This is the easiest way to use the Authorized
Managers feature.
7.2.2
Authorizing Multiple Stations:
The table entry uses the IP Mask to authorize access to the switch from a defined group of stations.
This is useful if you want to easily authorize several stations to have access to the switch without
typing in an entry for every station. All stations in the group are defined by the one Authorized
Manager IP table entry and its associated IP mask and will have the same access level.
To configure the switch for authorized manager access, enter the appropriate
Authorized Manager IP
value and specify an
IP Mask
. The IP Mask determines how the Authorized Manager IP value is used
for allowing or denying access to the switch by a management station.
7.3
Overview of IP Mask Operation
The default IP Mask is 255.255.255.255 and allows switch access only to a station having an IP
address that is identical to the Authorized Manager IP parameter value. (“255” in an octet of the mask
means that only the exact value in the corresponding octet of the Authorized Manager IP parameter is
allowed in the IP address of an authorized management station.) However, you can alter the mask and
the Authorized Manager IP parameter to specify ranges of authorized IP addresses. For example, a
mask of
255.255.255.0
and any value for the Authorized Manager IP parameter allows a range of 0
through 255 in the 4
th
octet of the authorized IP address. This enables a block of up to 254 IP
addresses for IP management access (excluding 0 for the network and 255 for broadcasts). A mask of
255.255.255.252
uses the 4
th
octet of a given Authorized Manager IP address to authorize four IP
addresses (252,253,254,and 255) for management station access.
Note
The IP Mask is a method for recognizing whether a given IP address is authorized for
management access to the switch. This mask serves a different purpose than IP subnet masks and is
applied in a different manner.
