Cabletron Systems 9032578-05 manual Configuring Layer-2 Address Filters

Chapter 20: Security Configuration Guide

A secure filter shuts down access to the SSR based on MAC addresses. All packets received by a port are dropped. When combined with static entries, however, these filters can be used to drop all received traffic but allow some frames to go through.

Configuring Layer-2 Address Filters

If you want to control access to a source or destination on a per-MAC address basis, you can configure an address filter. Address filters are always configured and applied to the input port. You can set address filters on the following:

•A source MAC address, which filters out any frame coming from a specific source MAC address

•A destination MAC address, which filters out any frame destined to specific destination MAC address

•A flow, which filters out any frame coming from a specific source MAC address that is also destined to a specific destination MAC address

To configure Layer-2 address filters, enter the following commands in Configure mode:

Configure a source MAC based	filters add address-filter name <name>
address filter.	source-mac <MACaddr> source-mac-
	mask <mask> vlan <VLAN-num> in-
	port-list<port-list>
Configure a destination MAC based	filters add address-filter name <name>
address filter.	dest-mac <MACaddr> dest-mac-mask
	<mask> vlan <VLAN-num> in-port-
	list <port-list>
Configure a Layer-2 flow address	filters add address-filter name <name>
filter.	source-mac <MACaddr> source-mac-
	mask <mask> dest-mac<MACaddr>
	dest-mac-mask <mask> vlan <VLAN-
	num> in-port-list<port-list>

280 SmartSwitch Router User Reference Manual