METRObility Optical Systems R821-1S, Инструкция по установке и эксплуатации

Страница: 27 / 127

25
Management
Setting a Secure Management Channel
By default, the R821’s VLAN identifier (VID) is 0, which indicates no
internal management VLAN. In this state, the card forwards all untagged
SNMP traffic through both ports, as illustrated below. No security is
provided, which means any device connected to any port can make
configuration changes to the R821.
Through software, you can create a secure management channel by
assigning it a new management VID
2
. The most secure configuration is
to have only one port (typically, the network port) enabled for
management. This is the recommended configuration, and it allows you
to restrict access to the card’s management agent, thus preventing
unauthorized modifications and other misuses.
The following table describes the available management options along
with the security vulnerabilities associated with each configuration.
2.Valid management VLAN IDs are in the range 1 to 4094.
Table 2: R821 Management Options and Vulnerabilities
Configuration Configuration Description Vulnerabilities
Management
VLAN
(single port)
A management VLAN ID is assigned
to one of the ports. Only frames that
contain this VID and are from the
specified port are allowed access to
the R821 management agent.
None
No
Management
VLAN
(single port)
One port is configured for
management. Any device connected
to this port can manage the R821. User could respond to
ARP request and steal
R821’s IP address.
Management
VLAN
(both ports)
A management VLAN ID is specified.
Any frame that contains the VID,
regardless of its source, is allowed to
access the R821 management agent.
Denial of service due to
misuse of unicast MAC
address.
R821 Services Line Card
Network Port
Access Port
Management Channel
untagged SNMP traffic untagged SNMP traffic
Management Agent
Console Port