General DataComm SpectraComm IP T1, Руководство по установке и эксплуатации

Страница: 23 / 120

Introduction and Specifications Security & Access Features
076R200-000 SpectraComm IP T1 Router Card 1-11
Issue 13 Installation and Operation Manual
Security & Access Features
SCIP devices are multi-level password-protected and employ inactivity timers at all access
interfaces. For periods of heightened security, authorized users can configure access controls to
filter out specific protocols, such as Telnet, HTTP, SNMP, FTP and/or TFTP access to the unit.
Security is further enhanced when the SCIP is configured for modem authentication,
authentication, Secure Shell protocol (SSH), and with Media Access Control Lists (MACL).
Secure Shell (SSH) Protocol
SCIP supports the Secure Shell (SSH) network protocol that allows data to be exchanged between
the SCIP and a remote user using a secure channel. The encryption used by SSH provides
confidentiality and integrity of data over an insecure network, such as the Internet. With SSH
enabled at the SCIP and the SSH client software available at the remote Windows workstation, the
remote user can create encrypted connections to the SCIP and its attached devices.
SCIP with MACL Security
SCIP in LAN-X mode supports MACL (Media Access Control List) Security which allows network
operators to identify valid and invalid users by the MAC address detected at the specific port being
accessed. SCIP uses a MAC address table to filter MAC addresses received at its Ethernet (LAN)
and WAN ports. Up to 100 valid MAC addresses can be defined for each interface, thereby filtering
traffic onto the network from only those addresses permitted at the associated port. Both the LAN
and WAN interfaces can be protected by MACL Security for simultaneous in-bound and out-bound
traffic validation. Since only valid users with high-level access privileges can execute MACL
commands, the MAC address table itself is protected from unwanted manipulation by users at
SCIP's WAN, LAN or dial-up access points.
Figure 1-6 shows the central site SCIP device with MAC Security enabled on the serial0 interface.
In this example, the MACL for this interface is configured with remote site equipment addresses:
mac1, mac2, and mac3, as well as MAC addresses for the remote SCIP and the managed SCES
device. The “hacker” is shown as a laptop at the remote location, attempting to connected to the
ethernet segment. Since the hacker’s MAC address (mac4) is not in the MACL, this traffic will be
discarded before reaching the customer's backbone. SCIP permits legal traffic to pass through the
interface, while hacker traffic is detected, dropped and reported.
Note
When MACL Security is enabled in the remote SCIP, illegal ingress traffic will be discarded before traversing
the T1 towards the backbone.
Note
MACL Security is only supported when the SCIP is placed in LAN-extension mode.