25-8 Riverstone Networks RS Switch Router User Guide Release 8.0
Layer-2 Security Filters Security Configuration
25.2.3 Configuring Layer-2 Static Entry Filters
Static entry filters allow or force traffic to go to a set of destination ports based on a frame's source MAC address,
destination MAC address, or both source and destination MAC addresses in flow bridging mode. Static entries are
always configured and applied at the input port. You can set the following static entry filters:
•Source static entry, which specifies that any frame coming from source MAC address will be
allowed or disallowed, or forced to go to a set of ports
•Destination static entry, which specifies that any frame destined to a specific destination MAC
address will be allowed, disallowed, or forced to go to a set of ports
•Flow static entry, which specifies that any frame coming from a specific source MAC address that
is destined to specific destination MAC address will be allowed, disallowed, or forced to go to a set
of ports
To configure Layer-2 static entry filters, enter the following commands in Configure mode:
25.2.4 Configuring Layer-2 Secure Port Filters
Secure port filters block access to a specified port. You can use a secure port filter by itself to secure unused ports.
Secure port filters can be configured as source or destination port filters. A secure port filter applied to a source port
forces all incoming packets to be dropped on a port. A secure port filter applied to a destination port prevents packets
from going out a certain port.
You can combine secure port filters with static entries in the following ways:
•Combine a source secure port filter with a source static entry to drop all received traffic but allow
any frame coming from specific source MAC address to go through.
•Combine a source secure port filter with a flow static entry to drop all received traffic but allow any
frame coming from a specific source MAC address that is destined to specific destination MAC
address to go through.
•Combine a destination secure port with a destination static entry to drop all received traffic but allow
any frame destined to specific destination MAC address go through.
•Combine a destination secure port filter with a flow static entry to drop all received traffic but allow
any frame coming from specific source MAC address that is destined to specific destination MAC
address to go through.
Configure a source static entry
filter. filters add static-entry name <name> restriction
allow|disallow|force source-mac <MACaddr>|any
source-mac-mask <mask> vlan <VLAN-num>|any in-port-list
<port-list> out-port-list <port-list>
Configure a destination static
entry filter. filters add static-entry name <name> restriction
allow|disallow|force dest-mac <MACaddr> dest-mac-mask
<mask>|any vlan <VLAN-num>|any in-port-list <port-list>
out-port-list <port-list>