Korenix JetNet 5228G Series, Руководство пользователя

Страница: 155 / 658

Client Security
3-109
3
Web – Click Security, ACL, Port Binding. Mark the Enable field for the port you want
to bind to an ACL for ingress or egress traffic, select the required ACL from the
drop-down list, then click Apply.
Figure 3-65 Configuring ACL Port Binding
CLI – This example assigns an IP access list to port 1, and an IP access list to
port 3.
DHCP Snooping
The addresses assigned to DHCP clients on unsecure ports can be carefully
controlled using the dynamic bindings registered with DHCP Snooping (or using the
static bindings configured with IP Source Guard). DHCP snooping allows a switch to
protect a network from rogue DHCP servers or other devices which send
port-related information to a DHCP server. This information can be useful in tracking
an IP address back to a physical port.
Command Usage
• Network traffic may be disrupted when malicious DHCP messages are received
from an outside source. DHCP snooping is used to filter DHCP messages received
on a non-secure interface from outside the network or firewall. When DHCP
snooping is enabled globally and enabled on a VLAN interface, DHCP messages
received on an untrusted interface from a device not listed in the DHCP snooping
table will be dropped.
• Table entries are only learned for trusted interfaces. An entry is added or removed
dynamically to the DHCP snooping table when a client receives or releases an IP
address from a DHCP server. Each entry includes a MAC address, IP address,
lease time, VLAN identifier, and port identifier.
Console(config)#interface ethernet 1/1 4-172
Console(config-if)#ip access-group david in 4-162
Console(config-if)#exit
Console(config)#interface ethernet 1/3
Console(config-if)#ip access-group david in
Console(config-if)#