Cisco ISA500 Series, Руководство администратора

Страница: 212 / 371

Firewall
Configuring the IP/MAC Binding to Prevent Spoofing
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 206
6
For example, if you click Add , the MAC Filtering - Add/Edit window opens. Select
the MAC address object from the MAC Address drop-down list, and then click
OK .
If the MAC address object you want is not in the list, choose Create New Address
to create a new MAC Address object. To maintain the MAC Address objects, go to
the
Networking -> Address Object Management page. See Address
Management, page 152 .
STEP 5
Click Save to apply your settings.
Configuring the IP/MAC Binding to Prevent Spoofing
The IP/MAC binding feature allows the traffic only when the host has an IP address
that matches up with a specified MAC address. By requiring the gateway to
validate the source traffic’s IP address with the unique MAC address of device,
please ensure that traffic from the specified IP address is not spoofed. If a violation
(the traffic’s source IP address doesn’t match up with the expected MAC address
having the same IP address) occurs, the packets will be dropped and can be
logged for diagnosis.
STEP 1
Click Firewall -> MAC Filtering -> IP/MAC Binding .
The IP/MAC Binding window opens.
STEP 2
To add an IP/MAC binding rule, click Add .
Other options: To edit an entry, click Edit . To delete an entry, click Delete . To
delete all selected entries, check the boxes of multiple entries and click Delete
Selection .
After you click Add or Edit, the IP/MAC Binding - Add/Edit window opens.
STEP 3
Enter the following information:
• Name: Enter a descriptive name for the IP/MAC binding rule.
• MAC Address: Choose an existing MAC address object. If the MAC address
object you want is not in the list, choose Create a MAC to add a new MAC
address object. To maintain the MAC address objects, go to the Networking
-> Address Object Management page. See Address Management,
page 152 .