Olicom 8600, 8605 manual Address Filtering, 115

115

Address Filtering

The Address Filtering feature enables you to restrict certain users from communicating with other users. To do this, you can specify source and destination MAC-layer Token-Ring addresses to be filtered at the source port. Token-Ring addresses can be unicast, multicast, or broadcast.

The advantage of address filtering is increased access control and network segmentation. For example, suppose one port is connected to a server containing confidential information from the engineering workgroup. You can prevent access to the server by setting up filters for the addresses of connections from workgroups other than engineering. This is an example of two “types” of filters, “allowing a source address” (engineering) or “blocking a source address(es)” (other workgroups). Examples of different types of filters are allowing, forcing, or blocking packets from a source address, or allowing, forcing, or blocking packets to a destination address. For a detailed explanation of filter types, see the “Configure Filters Screen” section within this chapter.

Observe the following guidelines when setting up address filters:

•

•

•

Use the Filters & Port Security menu to create port filters.

Filters are port specific and applied to a switch’s incoming traffic only.

Up to 250 “filters” can be created for each switch (the filters must be applied to specific ports at a specified switch). A “filter” is a combination of a MAC address and the “type” of filter it is. For example, if the MAC address 0000A3 C00021 is configured as source type at a port and also configured as a destination type, that would count as two different filters (towards the maximum of 250 filters).

•You can apply these filters to any combination of ports as long as there is a maximum of 250 filters (not 250 ports, because more than one port can be part of a filter). For example:

—Filter “A” (MAC address 0000A3 C00021, source type) can be applied to ports 1, 5, 7, 14 (or to all the ports)

—Filter “B” (MAC address 0000A3 C00021, destination type) can be applied to the same ports, or different ports, or once again, to all the ports

—Filter “C” (MAC address 0340B7 A02026, source type) can be applied to any combination of ports; until a maximum of 250 filters are created.

➽Note: If you set up a filter for broadcast packets, hosts on the other side of the switch may not see ARP broadcast packets. To prevent this, let the switch learn the host addresses before implementing the filter. Most hosts time out their local address entries and attempt to relearn with a broadcast ARP.

CrossFire 8600/8605 Token-Ring Switches v. 1.2, P/N: 710001641 Switch Configuration