HP 4100gl, 2650 (J4899A/B), 2626 (J4900A/B), 2600-PWR, 6108 manual Overview, 10-2

Traffic/Security Filters (ProCurve Series 2600/2600-PWR and 2800 Switches)

Overview

N o t e

Overview

This chapter describes the use of source-port filters on the Series 2600/

2600-PWR switches and on the Series 2800 switches. For information on filters for the Series 2500 switches, refer to the Management and Configuration Guide provided for these devices.

General Operation. You can enhance in-band security and improve control over access to network resources by configuring static per-port filters to forward (the default action) or drop unwanted traffic. That is, you can config- ure a traffic filter to either forward or drop all network traffic moving between an inbound (source) port or trunk and any outbound (destination) ports and trunks (if any) on the switch.

■With routing disabled on the switch (the default), source-port filtering can operate on traffic moving within the same VLAN.

■With routing enabled on the switch, source-port filtering can operate on traffic moving between VLANs as well as within the same VLAN. (However, if you configure and enable routing on the switch when multinetting within a VLAN has been configured, source-port filtering will not work.)

■Source-port filters have no effect on traffic being routed across VLANs.

The switch manages a port trunk as a single source or destination for source- port filtering. If you configure a port for filtering before adding it to a port trunk, the port retains the filter configuration, but suspends the filtering action while a member of the trunk. If you want a trunk to perform filtering, first configure the trunk, then configure the trunk for filtering. Refer to “Config- uring a Filter on a Port Trunk” on page 10-6.

When you create a source port filter, all ports or port trunks on the switch appear as destinations on the list for that filter. The switch automatically forwards traffic to the ports and/or trunks you do not specifically configure to drop traffic. (Destination ports that comprise a trunk are listed collectively by the trunk name—such as Trk1— instead of by individual port name.) For example, if you want to prevent server "A" from receiving traffic sent by workstation "X", but do not want to prevent any other servers or end nodes

10-2