Manuals / TP-Link / Computer Equipment / Switch

TP-Link TL-SG3424P manual Network Security, IP-MAC Binding

Models: TL-SG3424P

1 263

Download 263 pages 38.92 Kb

Page 160

Chapter 12 Network Security

Network Security module is to provide the multiple protection measures for the network security, including four submenus: IP-MAC Binding, ARP Inspection, DoS Defend and 802.1X. Please configure the functions appropriate to your need.

12.1 IP-MAC Binding

The IP-MAC Binding function allows you to bind the IP address, MAC address, VLAN ID and the connected Port number of the Host together. Based on the IP-MAC binding table and ARP Inspection functions, you can control the network access and only allow the Hosts matching the bound entries to access the network.

The following three IP-MAC Binding methods are supported by the switch.

（1） Manually: You can manually bind the IP address, MAC address, VLAN ID and the Port number together in the condition that you have got the related information of the Hosts in the LAN.

（2） Scanning: You can quickly get the information of the IP address, MAC address, VLAN ID and the connected port number of the Hosts in the LAN via the ARP Scanning function, and bind them conveniently. You are only requested to enter the range of the IP address on the ARP Scanning page for the scanning.

（3） DHCP Snooping: You can use DHCP Snooping functions to monitor the process of the Host obtaining the IP address from DHCP server, and record the IP address, MAC address, VLAN and the connected Port number of the Host for automatic binding.

These three methods are also considered as the sources of the IP-MAC Binding entries. The entries from various sources should be different from one another to avoid collision. Among the entries in collision, only the entry from the source with the highest priority will take effect. These three sources (Manual, Scanning and Snooping) are in descending order of priority.

The IP-MAC Binding function is implemented on the Binding Table, Manual Binding, ARP Scanning and DHCP Snooping pages.

12.1.1 Binding Table

On this page, you can view the information of the bound entries.

Choose the menu Network Security→IP-MAC Binding→Binding Table to load the following page.

Figure 12-1 Binding Table

151

Image 160

TP-Link TL-SG3424P manual Network Security, IP-MAC Binding

Contents

TL-SG3424P JetStream L2 Managed PoE Switch REV2.0.0 1910010781Copyright & Trademarks FCC Statement Safety Information Contents Gvrp VII Viii 177 220 Package Contents About this Guide Intended ReadersConventions Overview of This GuideSystem Switching Vlan Spanning Tree Multicast QoS PoE ACL Network Security Snmp Return to Contents Main Features Overview of the SwitchIntroduction Front Panel Appearance Description¾ LEDs LED Status IndicationRear Panel Login Login to the SwitchConfiguration Return to Contents System System InfoSystem Summary ¾ Port StatusPort TypeSpeed StatusSystem Time Device Description¾ Device Description Daylight Saving Time ¾ DST Config Predefined ModeRecurring Mode Date Mode¾ IP Config System IPUser Management User ConfigUser Table User ID, Name, Access Level and status Operation ¾ User InfoUser Status ¾ User TableConfig Restore Config Backup¾ Config Restore System ToolsFirmware Upgrade ¾ Config BackupAccess Security System RebootSystem Reset Access Control¾ Access Control Config ¾ Session ConfigIP Address&Mask MAC AddressSSL Config ¾ Access User NumberSSH Config ¾ Global Config¾ Certificate Download ¾ Key DownloadProtocol Idle TimeoutMax Connect ¾ Configuration Procedure Key TypeDownload ¾ Network RequirementsApplication Example 2 for SSH Page Return to Contents Switching Port ConfigPort Port SelectPort Mirror DescriptionSpeed and Duplex Flow ControlGroup MirroringMode Mirrored PortPort Security ¾ Mirrored PortIngress EgressMax Learned MAC ¾ Port SecurityLearned Num ¾ Port Isolation Config Port Isolation¾ Port Isolation List Loopback DetectionForward Portlist Display the forwardlist LAG Operation ModeInterval It’s 3 seconds LAG Table LAG TableStatic LAG ¾ LAG TableGroup Number MemberLacp Config Member Port10 Lacp Config ¾ Lacp ConfigAdmin Key Traffic MonitorTraffic Summary Port PriorityPackets Rx Packets TxOctets Rx Octets TxTraffic Statistics Type Configuration Way Aging out MAC AddressBound Address and the portAddress Table RelationshipStatic Address ¾ Search Option¾ Address Table Displays the corresponding Vlan ID of the MAC address¾ Create Static Address ¾ Static Address TableDynamic Address ¾ Aging Config ¾ Dynamic Address TableFiltering Address Bind¾ Create Filtering Address ¾ Filtering Address TableVlan 802.1Q Vlan ¾ Link Types of ports¾ Pvid Vlan Config ¾ Vlan TableVlan ID Select： Select：¾ Vlan Config Enter the ID number of VlanIs valid or not ¾ Vlan Members¾ Vlan Port Config Port Displays the port numberRequired. On the VLAN→802.1Q VLAN→Port Config page, set ¾ Vlan of PortVlan Description Step Operation DescriptionRequired. On the VLAN→802.1Q VLAN→VLAN Config Optional. On the VLAN→802.1Q VLAN→VLAN Config¾ MAC Vlan Table Protocol VlanMAC Select ¾ Encapsulation Format of Ethernet Data 802.3 raw 802.2 LLC Snap Protocol Protocol Group Table Protocol GroupVlan packets are processed in the following way ¾ Protocol Group TableProtocol Template ¾ Protocol Group Config¾ Protocol Group Member ¾ Create Protocol Template Required. On the VLAN→802.1Q VLAN→Port Config¾ Protocol Template Table ¾ Network Diagram Application Example for 802.1Q VlanRequired. On the VLAN→Protocol VLAN→Protocol Optional. On the VLAN→Protocol VLAN→Protocol VlanRequired. On VLAN→802.1Q VLAN→Port Config page, configure Required. On VLAN→802.1Q VLAN→VLAN Config page, create aApplication Example for MAC Vlan Operation Description¾ Network Diagram ¾ Configuration Procedure Application Example for Protocol Vlan Required. On VLAN→Protocol VLAN→Protocol Template Gvrp On VLAN→Protocol VLAN→Protocol Group page, create protocol¾ Gvrp Registration Mode GvrpConfiguration Procedure Spanning Tree ¾ STP Elements¾ Bpdu Comparing Principle in STP mode ¾ STP Timers¾ STP Generation Step Operation Tips ：¾ Rstp Elements ¾ Mstp Elements¾ Port States ¾ Port RolesSTP Config STP ConfigForward Delay VersionHello Time Max AgeSTP Summary Port Config STP SummaryPriority ExtPathIntPath Edge PortMstp Instance Region ConfigPort Status Instance Config ¾ Region ConfigInstance Port Config ¾ Instance TableInstance ClearPath Cost Instance IDPort Role STP Security Port Protect¾ Bpdu Protect ¾ TC Protect¾ Bpdu Filter Loop Protect Root ProtectTC Protect Bpdu ProtectApplication Example for STP Function TC ProtectOn Spanning Tree→STP Config→Port Config On Spanning Tree→STP Config→STP ConfigOn Spanning Tree→MSTP Instance→Instance Configure Switch D ¾ Suggestion for Configuration Multicast ¾ Multicast Overview¾ Multicast Address Table ¾ Multicast AddressMulticast IP Port Igmp Snooping ¾ Igmp Snooping¾ Igmp Snooping Process ¾ Igmp MessagesSnooping Config ¾ Igmp Snooping Fundamentals¾ Igmp Snooping Status Description Displays Igmp Snooping status MemberIgmp Snooping Fast LeaveRouter Port Time Member Port TimeLeave Time Static Router PortSnooping→Snooping Config and Port Config Multicast→IGMP Snooping→VLAN ConfigMulticast Vlan Multicast→IGMP¾ Multicast Vlan VlanOn the Multicast→IGMP Snooping→Snooping Config Multicast→IGMP Snooping→Multicast VlanSnooping→Port Config Snooping→Snooping ConfigMulticast IP Multicast IP TableStatic Multicast IP Multicast Filter IP-Range¾ Create Static Multicast ¾ Static Multicast IP TablePort Filter IP Range IDStart Multicast IP End Multicast IP¾ Port Filter Config Action ModeFilter Bound IP-Range IDMulticast→Multicast Filter→IP-Range Packet StatisticsMulticast→Multicast Filter→Port Filter ¾ Igmp Statistics QoS ¾ Priority Mode¾ QoS ¾ Schedule Mode 117 ¾ Port Priority Config DiffServPort Priority Displays the LAG number which the port belongs toRequired. On QoS→DiffServ→Schedule Mode ¾ Dscp Priority ConfigDscp Priority Required. On QoS→DiffServ→Port Priority¾ Priority Level 3 802.1P/CoS mappingRequired. On QoS→DiffServ→DSCP Priority ¾ Priority and CoS-mapping Config Schedule Mode¾ Schedule Mode Config Bandwidth Control Rate Limit¾ Rate Limit Config Storm ControlIngress Rate Kbps Egress RateKbps¾ Storm Control Config Port Broadcast Rate bpsMulticast Rate BpsVoice Vlan ¾ Port Voice Vlan ModeNumber OUI Address Vendor ¾ Security Mode of Voice Vlan Security Packet Type Processing ModeGlobal Config 12 Global ConfigurationPort Mode 13 Port ConfigOUI Config Required. On VLAN→802.1Q VLAN→Port Config page, click MaskPoE Config PoE¾ Composition ¾ AdvantagePoE Status PoE ConfigPoE Priority PoE Profile PoE Time-Range Time-Range Summary¾ PoE Profile Profile NamePoE Time-Range Create PoE Holiday Config IndexEnd Time DeleteTime-Range ACL¾ Time-Range Table Holiday Time-Range CreateIndex Displays the index of the time-slice Start Time ACL Config Holiday ConfigACL Summary ACL Create¾ Rule Table ¾ Create ACLMAC ACL Rule IDEtherType User PriorityExtend-IP ACL Standard-IP ACL¾ Create Standard-IP ACL ¾ Create Extend-IP ACL IP ProtocolTCP Flag ： IP ToSPolicy Summary Policy ConfigPolicy Create ¾ Create Policy Action Create¾ Create Action Binding Table Policy Binding¾ Policy Bind Table ¾ Port-Bind Config Port BindingVlan Binding Direction Displays the binding direction¾ VLAN-Bind Config Application Example for ACLEnter the ID of the Vlan you want to bind ¾ VLAN-Bind TableOn ACL→ACL Config→ACL Create page, create ACL On ACL→ACL Config→Standard-IP ACL page, select ACL Network Security IP-MAC BindingManual Binding ¾ Manual Binding Option Enter the Vlan IDProtect Type Select the Protect Type for the entry ¾ Manual Binding TableARP Scanning Dhcp Snooping Start IP AddressEnd IP Address ScanNetwork diagram for DHCP-snooping implementation ¾ Dhcp Working Principle¾ Option Dhcp Cheating Attack Implementation Procedure ¾ Dhcp Cheating Attack¾ Dhcp Snooping Config ¾ Port Config Port Select ¾ Option 82 ConfigCustomization Circuit ID Remote ID ¾ Imitating Gateway ARP Inspection¾ Cheating Gateway 10 ARP Attack Cheating Gateway ¾ Cheating Terminal Hosts¾ Man-In-The-Middle Attack ¾ ARP Flooding Attack ¾ ARP Detect ARP Detect¾ Trusted Port Required. On the Network Security→IP-MAC ARP DefendNetwork Security→ARP Defend ¾ ARP DefendCurrent Speed ARP Statistics DoS Defend¾ Illegal ARP Packet DoS Attack Type Description ¾ Configure ¾ Architecture of 802.1X Authentication12.4 ¾ Defend Table¾ The Mechanism of an 802.1X Authentication System ¾ 802.1X Authentication Procedure 19 PAP Authentication Procedure ¾ 802.1X Timer ¾ Guest VlanAuthentication Method 802.1XGuest Vlan Guest Vlan IDServer Timeout Supplicant TimeoutRetry Times Control Mode ¾ Authentication ConfigRadius Server Control TypeRequired. On the Network Security→802.1X→Radius On the Network Security→802.1X→Global ConfigRequired. On the Network Security→802.1X→Port Snmp ¾ Snmp Overview¾ Snmp Management Frame ¾ Snmp Versions¾ Snmp Configuration Outline ¾ MIB Introduction¾ Local Engine Snmp Config¾ Remote Engine Snmp View View NameMIB Object ID View Type¾ Group Config Snmp GroupSnmp User Auth Mode Auth PasswordPrivacy Mode Privacy PasswordAccess ¾ Community ConfigSnmp Community Required. On the SNMP→SNMP Config→Global Required. On the SNMP→SNMP Config→SNMPMIB View ¾ Community TableOn the SNMP→SNMP Config→SNMP NotificationTimeout UDP PortUser RetryRmon ¾ Notification Table¾ Rmon Group Rmon Group FunctionHistory Control Event Config¾ History Control Table Alarm Config ¾ Event TableAlarm Type VariableSample Type Rising Threshold194 Lldp ¾ Lldpdu Format¾ TLV TLV type TLV Name Description UsageBasic Management TLV Organizationally Specific TLVConfiguration/Status TLV Power Via MDI TLVPort Description TLV System Capabilities TLVBasic Config Lldp¾ Lldp Port Config Lldp Port ConfigLocal Info Device InfoDetails ¾ Local Info Neighbor Info¾ Neighbor Info Device Statistics ¾ Global StatisticsErrors Transmit TotalReceive Total DiscardsExtended Power-Via-MDI TLV ¾ LLDP-MED Parameters ConfigLocation Identification TLV Inventory TLV¾ LLDP-MED Port Config LLDP-MED Port Configuration¾ Included TLVs ¾ Location Identification ParametersEmergency Civic AddressLLDP-MED Local Information LLDP-MED Neighbor Information Cluster ¾ Cluster Role15.1 NDP ¾ Introduction to ClusterNDP Summary ¾ NeighborError NDP Packets Aging TimeSend NDP Packets Receive NDP PacketsNDP Config Detail ：Enable DisableNtdp Device TableNtdp Summary Port Displays the port number of the switch Ntdp SummaryNtdp Config Ntdp Hop DelayNtdp Interval Time Ntdp HopsCluster Cluster Summary¾ Global ClusterCluster Config ¾ Global Config Cluster¾ Current Role ¾ Role Change14 Cluster Configuration for Individual Switch Application Example for Cluster FunctionOn Cluster→NDP→NDP Config page, enable NDP On Cluster→NTDP→NTDP Config page, enableOn Cluster→Cluster→Member Config page, select On Cluster→Cluster→Cluster TopologySystem Monitor MaintenanceCPU Monitor Memory Monitor 16.2 Log Log Table ¾ Log InfoTime Module¾ Local Log Config Local LogRemote Log Log Buffer¾ Log Host Backup LogHost IP Device Diagnostics ErrorCable Test PairLoopback Network DiagnosticsPing ¾ Ping Config Tracert¾ Tracert Config Appendix a Specifications Appendix B Configuring the PCs Figure B-2Now Hardware Installation Appendix C Load Software Using FTPConfigure the Hyper Terminal 239 Download Firmware via bootUtil menu Figure C-5 Port SettingsTP-LINK upgrade You can only use the port 1 to upgrade Are you want to upgrade the firmwareY/N yTP-LINK start Start UserInstallation Guide Appendix D 802.1X Client Software244 245 Uninstall Software Figure D-7 InstallShield Wizard CompleteConfiguration Figure D-11 Uninstall Complete248 Figure D-16 Connection Status FAQ Appendix E Glossary Multicast Switching Generic Multicast Registration Protocol GmrpGroup Attribute Registration Protocol Garp Ieee 802.1DPort Authentication Remote Authentication Dial-in User Service RadiusLayer Link AggregationSecure Shell SSH Simple Network Management Protocol SnmpSimple Network Time Protocol Sntp Spanning Tree Algorithm STA