Allied Telesis Layer 3 Switches manual Add ip int=vlan500 ip=172.16.5.103 mask=255.255.255.0

Page 29

Appendix: Configuration scripts for MAC-forced forwarding example

Edge switch 3

Edge switch 3 is connected to port 49 of edge switch 1. The configuration is similar to edge switch 1—differences are in bold:

# System configuration

set system name="Edge Switch 3"

#VLAN general configuration create vlan=Voice vid=100 private create vlan=Video vid=200 private create vlan=Data vid=300 private create vlan=Management vid=400 private create vlan=EAN_Management vid=500 private

#STP general configuration

enable stp=default

set stp=default mode=rapid

#VLAN port configuration

#unlike switch 1, ports 1, 2 and 15 are not in any VLANs add vlan=100 port=49-50 uplink frame=tagged

add vlan=200 port=49-50 uplink frame=tagged add vlan=300 port=49-50 uplink frame=tagged add vlan=400 port=49-50 uplink frame=tagged add vlan=500 port=49-50 uplink frame=tagged

#STP port configuration

set stp=default port=1-48 edgeport=yes

#DHCP Snooping configuration

#unlike switch 1, there is no maxlease setting for port 15 or static bindings enable dhcpsnooping

enable dhcpsnooping arpsecurity enable dhcpsnooping option82

set dhcpsnooping port=49 trusted=yes set dhcpsnooping port=50 trusted=yes

#IP configuration

enable ip

add ip int=vlan500 ip=172.16.5.103 mask=255.255.255.0

#MACFF configuration enable macff int=vlan100 enable macff int=vlan200 enable macff int=vlan300 enable macff int=vlan400 enable macff int=vlan500

Create A Secure Network With Allied Telesis Managed Layer 3 Switches

29

Page 28 Page 30
Image 29
Page 28 Page 30
Contents
Introduction ContentsEdge switch Access Router Protecting against packet flooding Securing the deviceProtecting the network Bandwidth limiting Configuration To use storm protection Using QoS policy-based storm protectionRest of the QoS configuration is as normal, so Reboot after turning on enhanced modeConfiguration on one or more ports Protecting against rapid MAC movementIgmp snooping Controlling multicast trafficIgmp throttling Configuration For each portIgmp filtering Managing the device securely Using Secure Shell SSHConfiguration Configuration 1. Enable Snmp Using SSL for secure web accessUsing SNMPv3 Managing the device securely Building a whitelist through layer 3 filters Whitelisting telnet hostsBuilding a whitelist through QoS Trouble with ARP Identifying the userIP spoofing and tracking Dhcp snooping Rejecting Gratuitous ARP GarpUsing static binding for rigid control Setting up Dhcp snoopingUsing ARP security Using 802.1x port authenticationUsing Dhcp snooping to track clients Protecting the user Using private VLANsTo remove ports from the Vlan Using local proxy ARP and MAC-forced forwardingLocal proxy ARP Configuration of access router Example Add ip int=vlan104 ip=address-in-192.168.4.0-subnet MAC-Forced Forwarding Macff Switches Using IPsec to make VPNsAccess EdgeBlocking worms through classifier-based filters Protecting against wormsBlocking worms through QoS actions Edge switch 1 is directly connected to the access router Edge switchEdge switch Add ip int=vlan500 ip=172.16.5.103 mask=255.255.255.0 Access Router C613-16103-00 REV a