Extreme Networks EPICenter 5.0, Руководство пользователя

Страница: 105 / 208

Network Access Security
EPICenter Concepts and Solutions Guide 105
EPICenter creates a dynamic log of syslog messages in the Reports feature. Use this log to scan for
critical security events such as:
You must make sure the EPICenter is configured as a Syslog server on the devices you want to monitor.
One convenient way to do this is to use a Telnet macro—you can perform this on the multiple devices
in your network in one operation. See “Example 1: A Macro to Configure EPICenter as a Syslog Server
on a Device” on page 79 for an example of a script to perform this function.
Network Access Security
Network administrators need to prevent unauthorized access to their network to protect sensitive
corporate data as well as to guarantee network availability. To achieve this, you need to combine edge
security features such as firewalls with network controls such as IP access lists and network
segmentation using VLANs. Unauthorized access attempts can originate from hosts external to your
network as well as from benign or malicious attempts from within your network that can disrupt or
overload your enterprise network. Using EPICenter, you can configure access lists to allow or deny
traffic on your network, and you can configure VLANs to segment your physical LAN into multiple
isolated LANs to separate departmental or sensitive traffic within your enterprise network.
Using VLANs
VLANs segment your physical LAN into independent logical LANs that can be used to isolate critical
segments of your network or network traffic from one another. Using VLANs, you can create
autonomous logical segments on your network for different business needs, such as creating a
Marketing VLAN, a Finance VLAN, and a Human Resources VLAN. All the hosts for marketing
personnel reside on the Marketing VLAN, will all the hosts for finance personnel reside on the Finance
VLAN. This isolates marketing and finance traffic and resources, preventing any unauthorized access to
financial information from any other group.
VLANs work by assigning a unique VLAN ID to each VLAN, and then assigning hosts to the
appropriate VLAN. All traffic from that host is tagged with the VLAN ID, and directed through the
network based on that VLAN ID. In the marketing and finance example, each department can be on the
Table 3: Security-based Syslog Messages
Error Message Explanation
<CRIT:IPHS> Possible spoofing
attack
You have a duplicate IP address on the network (same as an
address on a local interface).
or
The IP source address equals a local interface on the router and the
packet needs to go up the IP stack i.e., multicast/broadcast. In the
BlackDiamond, if a multicast packet is looped back from the switch
fabric, this message appears.
USER: Login failed for user
through telnet
A login attempt failed for an administrative user attempting to connect
to a device using telnet.
SYST: card.c 1000: Card 3
(type=2) is removed.
A card has been removed from the device. This is a possible breach of
physical security if this is an unauthorized removal.
<WARN:KERN> fdbCreatePermEntry:
Duplicate entry found mac
00:40:26:75:06:c9, vlan 4095
A duplicate MAC address appeared on the network. This is a possible
client spoofing attempt.