Programmable Filtering
Security—“Filter if Destination”
Filter if Destination is a function that allows you to filter an Ethernet frame based on the destination of its address. If the destination address equals the address that the Filter if Destination function has been applied to, the frame is filtered.
Example:
Assume that a host Computer is located on LAN segment 2 located on a partner bridge/router with an Ethernet address of:
00-00-01-02-03-04 (host Ethernet address)
Since each station on a LAN has a unique Ethernet address, this address uniquely identifies this host computer.
To prevent LAN users located on segment 1, located on the local bridge/router, from accessing this host system, follow the instructions below:
1From the MAIN MENU of the console of the local bridge/router, enter a 1.
(Enter a “=“ from any menu to go back to the MAIN MENU.)
This will place you at the CONFIGURATION MENU, where access to the filtering menu is obtained.
2From the CONFIGURATION MENU, enter an 8.
This will place you at the FILTER
3From the FILTER
This will place you at the MAC ADDRESS FILTERS MENU, where access to the MAC Address filters is obtained.
4From the MAC ADDRESS FILTERS MENU, make sure that Filter Operation is currently set to positive.”
This will cause the MAC Address Filters specified to be used for filtering frames with the specified MAC addresses.
5From the MAC ADDRESS FILTERS MENU, enter a 1.
This will place you at the first EDIT MAC ADDRESS FILTER MENU screen. At the prompt enter the MAC address for which you want to specify the filter.
6Enter the
The edit screen will fill in the information that the table knows about this address. For this example, let us assume that it knows that the address is “present” and located on the LAN of the partner bridge/router.
7Enter a 4 to Enable the “Filter if Destination” parameter. The screen will be updated with the new information.
At this point, the address is added to the permanent filter table of the local LAN. This entry, therefore, will not be subject to the aging timer, and will remain active until it is removed from the permanent entry table.
When a frame of information is seen on the local LAN that contains the address of the host system in the destination field of the frame, the bridge/router will not forward it, effectively preventing any access to this host from the local LAN.
B.2 —