Network Security, IP-MAC Binding | TP-Link TL-SL5428E specs

Chapter 11 Network Security

Network Security module is to provide the multiple protection measures for the network security, including five submenus: IP-MAC Binding, ARP Inspection, IP Source Guard, DoS Defend and 802.1X. Please configure the functions appropriate to your need.

11.1 IP-MAC Binding

The IP-MAC Binding function allows you to bind the IP address, MAC address, VLAN ID and the connected Port number of the Host together. Basing on the IP-MAC binding table, ARP Inspection and IP Source Guard functions can control the network access and only allow the Hosts matching the bound entries to access the network.

The following three IP-MAC Binding methods are supported by the switch.

（1） Manually: You can manually bind the IP address, MAC address, VLAN ID and the Port number together in the condition that you have got the related information of the Hosts in the LAN.

（2） Scanning: You can quickly get the information of the IP address, MAC address, VLAN ID and the connected port number of the Hosts in the LAN via the ARP Scanning function, and bind them conveniently. You are only requested to enter the IP address on the ARP Scanning page for the scanning.

（3） DHCP Snooping: You can use DHCP Snooping functions to monitor the process of the Host obtaining the IP address from DHCP server, and record the IP address, MAC address, VLAN and the connected Port number of the Host for automatic binding.

These three methods are also considered as the sources of the IP-MAC Binding entries. The entries from various sources should be different from one another to avoid collision. Among the entries in collision, only the entry from the source with the highest priority will take effect. These three sources (Manual, Scanning and Snooping) are in descending order of priority.

The IP-MAC Binding function is implemented on the Binding Table, Manual Binding, ARP Scanning and DHCP Snooping pages.

11.1.1 Binding Table

On this page, you can view the information of the bound entries.

Choose the menu Network Security→IP-MAC Binding→Binding Table to load the following page.

Figure 11-1 Binding Table

155

Image 163

TP-Link TL-SL5428E manual Network Security, IP-MAC Binding

Contents

Rev 1910010529 Copyright & Trademarks Contents Gvrp TC Protect 101 11.4.1 Ntdp 11.4.2 VII Package Contents Overview of This Guide About this GuideIntended Readers Conventions Path Switch, which facilitates you to monitor the Igmp messages Return to Contents Main Features Overview of the SwitchIntroduction Front Panel Appearance Description¾ LEDs Name Status Indication Rear Panel Login Login to the SwitchConfiguration Return to Contents ¾ Port Status SystemSystem Info System Summary Rate ¾ Port InfoPort Type ¾ Bandwidth Utilization Device Description¾ Device Description System Time ¾ Time Config¾ Time Info System IP User Table User Manage ¾ User Info User Config User ID, Name, Access Level and status Operation Config RestorePassword Confirm Password Retype the password Firmware Upgrade Config Backup¾ Config Backup System Reset System Reboot Access Control Access Security MAC Address ¾ Access Control Config¾ Session Config IP Address&Mask ¾ Access User Number SSL Config ¾ Key Download SSH Config¾ Global Config ¾ Certificate Download Protocol Idle TimeoutMax Connect ¾ Network Requirements ¾ Configuration ProcedureKey Type Download Application Example 2 for SSH Page Return to Contents Port Select SwitchingPort Config Port Flow Control Port MirrorDescription Speed and Duplex Egress ¾ Mirroring Port¾ Mirrored Port Ingress ¾ Port Security Port Security Max Learned MAC Port IsolationLearned Num Forward Portlist Display the forwardlist ¾ Port Isolation ConfigForward Portlist Select the port that to be forwarded to ¾ Port Isolation List LAG Table LAG Member Aggregate Arithmetic¾ LAG Table Group Number Static LAG ¾ LAG Config LAG will delete this LAG Lacp Config Port Priority ¾ Lacp ConfigAdmin Key System Priority Traffic Summary Traffic Monitor¾ Auto Refresh Traffic Statistics MAC Address Address and the port Type Configuration Way Aging outRelationship Bound ¾ Address Table ¾ Search Option ¾ Create Static Address MAC Address Displays the MAC address learned by the switchStatic Address Displays the corresponding Vlan ID of the MAC address ¾ Static Address Table Dynamic Address ¾ Dynamic Address Table ¾ Aging Config Bind Filtering Address ¾ Filtering Address Table ¾ Create Filtering Address Vlan implementation Vlan ¾ Link Types of ports 802.1Q Vlan ¾ Pvid Vlan Config Members Operation ： ¾ Vlan TableVlan ID Select Description ： ¾ Vlan Members ¾ Vlan ConfigEnter the ID number of Vlan Is valid or not Port Displays the port number ¾ Vlan Port Config Vlan Description Required. On the VLAN→802.1Q VLAN→Port Config page, setRequired. On the VLAN→802.1Q VLAN→VLAN Config ¾ Vlan of Port MAC Vlan Optional. On the VLAN→802.1Q VLAN→VLAN Config ¾ MAC Vlan Table Port EnableMAC Select Protocol Vlan Required. On the VLAN→MAC VLAN→Port Enable ¾ Protocol Vlan Table Protocol VlanProtocol Template ¾ Create Protocol Vlan ¾ Protocol Template Table ¾ Create Protocol Template Application Example for 802.1Q Vlan Operation Description Required. On VLAN→802.1Q VLAN→Port Config page, configureRequired. On VLAN→802.1Q VLAN→VLAN Config page, create a Application Example for MAC Vlan ¾ Network Diagram ¾ Configuration Procedure Application Example for Protocol Vlan Required. On VLAN→Protocol VLAN→Protocol Template Protocol type Value On VLAN→Protocol VLAN→Protocol Vlan page, create protocol Vlan Mapping VPN Config¾ VPN Up-link Ports ¾ Vlan Mapping Table ¾ Vlan Mapping Config Required. On the VLAN→VLAN VPN→VLAN Mapping Required. On the VLAN→VLAN VPN→VPN ConfigOptional. On the VLAN→VLAN VPN→VPN Config Required. On the VLAN→VLAN VPN→Port Enable ¾ Garp Gvrp ¾ Gvrp Select Port Status Registration Mode ¾ Port Config Private Vlan Configuration Procedure ¾ The Elements of a Private Vlan ¾ Features of Private Vlan¾ Private Vlan Implementation Pvid ¾ Packet forwarding in Private Vlan Pvlan Secondary Vlan ¾ Create Private Vlan¾ Private Vlan Table Primary Vlan Required. On the VLAN→Private VLAN→PVLAN Port Select the desired port for configuration Port TypeRequired. On the VLAN→Private VLAN→Port Configure ¾ Private Vlan Port Table Application Example for Private Vlan Required. On the VLAN→802.1Q VLAN→VLAN Config page, click ¾ STP Elements Spanning Tree ¾ Bpdu Comparing Principle in STP mode ¾ STP Timers Step Operation ¾ STP Generation ¾ Rstp Elements Tips：¾ Mstp Elements ¾ Port Roles ¾ Port States STP Config STP Config Max Age Forward DelayVersion Hello Time STP Summary STP Summary Port Config Edge Port PriorityExtPath IntPath Port Status Region ConfigMstp Instance Port Role ¾ Region Config Instance Config Clear Instance Port Config¾ Instance Table Instance Path Cost Instance ID Port Protect STP Security ¾ Bpdu Protect ¾ TC Protect¾ Bpdu Filter Bpdu Protect Loop ProtectRoot Protect TC Protect 11 TC Protect TC Protect On Spanning Tree→MSTP Instance→Instance On Spanning Tree→STP Config→STP ConfigOn Spanning Tree→STP Config→Port Config Application Example for STP Function Bridge of Instance Configure Switch D ¾ Suggestion for Configuration ¾ Multicast Overview Multicast¾ Multicast Address Multicast IP Port ¾ Multicast Address Table ¾ Igmp Messages Igmp Snooping¾ Igmp Snooping ¾ Igmp Snooping Process ¾ Igmp Snooping Fundamentals Snooping Config Description Displays Igmp Snooping status Member ¾ Igmp Snooping Status Fast Leave Igmp Snooping Static Router Port Router Port TimeMember Port Time Leave Time Router Port Snooping→Snooping Config and Port ConfigMulticast→IGMP Snooping→VLAN Config Multicast Vlan ¾ Multicast Vlan Multicast→IGMP Snooping→Multicast Vlan On the Multicast→IGMP Snooping→Snooping ConfigApplication Example for Multicast Vlan Vlan Multicast IP ¾ Configuration Procedure Step Operation DescriptionSnooping→Port Config Snooping→Snooping Config Static Multicast IP Multicast IP Table ¾ Static Multicast IP Table ¾ Create Static Multicast IP-Range Multicast Filter Port Filter ¾ Port Filter Config Multicast→Multicast Filter→IP-Range Packet StatisticsMulticast→Multicast Filter→Port Filter ¾ Igmp Statistics QoS ¾ Priority Mode¾ QoS 802.1Q frame ¾ Schedule Mode SP-Mode Displays the LAG number which the port belongs to ¾ Port Priority ConfigDiffServ Port Priority ¾ Schedule Mode Config Schedule Mode 3 802.1P Priority ¾ 802.1P Priority Config¾ Priority Level Dscp Priority Priority levels are labeled as TC0, TC1, TC2 and TC3 ¾ Dscp Priority ConfigIt ranges from 0 to Priority Level Bandwidth Control ¾ Rate Limit ConfigRate Limit Ingress Rate bps Storm ControlEgress Ratebps Multicast Rate ¾ Storm Control ConfigBroadcast Rate Bps Voice Vlan ¾ Port Voice Vlan ModeNumber OUI Address Vendor Packet Type Processing Mode ¾ Security Mode of Voice Vlan 12 Global Configuration Global Config 13 Port Config Port Mode OUI Config Required. On QoS→Voice VLAN→Global Config Required. On VLAN→802.1Q VLAN→Port ConfigOptional. On QoS→Voice VLAN→OUI Config page, you Required. On QoS→Voice VLAN→Port Config Index ACLTime-Range Time-Range Summary Time-Range Create ¾ Holiday Table ACL ConfigHoliday Config ¾ Create Holiday ¾ Create ACL ACL SummaryACL Create ¾ Rule Table EtherType MAC ACL¾ Create MAC ACL Rule ID Mask Standard-IP ACL¾ Create Standard-IP ACL Fragment ¾ Create Extend-IP ACL Extend-IP ACL Policy Summary Policy Config Desired policy, please click the Delete button Policy CreateAction Create Select Policy ¾ Create Action 11 Action Create ¾ Policy Bind Table Policy BindingBinding Table Port Binding Direction Displays the binding direction Vlan BindingEnter the ID of the Vlan you want to bind ¾ VLAN-Bind Table Application Example for ACL On ACL→ACL Config→ACL Create page, create ACL On ACL→ACL Config→Standard-IP ACL page, select ACL IP-MAC Binding Network Security Manual Binding ¾ Manual Binding Table ¾ Manual Binding OptionEnter the Vlan ID Protect Type Select the Protect Type for the entry ARP Scanning Scan Dhcp SnoopingStart IP Address End IP Address ¾ Dhcp Working Principle Network diagram for DHCP-snooping implementation ¾ Option ¾ Dhcp Cheating Attack Dhcp Cheating Attack Implementation Procedure 163 Customization Circuit ID Remote ID ¾ Option 82 Config¾ Port Config Port Select Decline Threshold Decline Flow Control ¾ Imitating Gateway ARP Inspection¾ Cheating Gateway ¾ Cheating Terminal Hosts 10 ARP Attack Cheating Gateway ¾ Man-In-The-Middle Attack ¾ ARP Flooding Attack ¾ ARP Detect ARP Detect¾ Trusted Port Required. On the Network Security→IP-MAC ARP DefendNetwork Security→ARP Speed ARP Statistics¾ ARP Defend Defend ¾ Illegal ARP Packet IP Source Guard DoS Defend ¾ IP Source Guard Config DoS Attack Type Description DoS Detect DoS Defend Attack Type 11.5Detect Time Detect ¾ 802.1X Authentication Procedure ¾ The Mechanism of an 802.1X Authentication System 178 179 ¾ Guest Vlan ¾ 802.1X Timer Guest Vlan ID Authentication Method802.1X Guest Vlan Server Timeout Supplicant TimeoutRetry Times Authorized Control ModeRadius Server Control Type Required. On the Network Security→802.1X→Port On the Network Security→802.1X→Global Config802.1X Client Software Required. On the Network Security→802.1X→Radius ¾ Snmp Versions Snmp¾ Snmp Overview ¾ Snmp Management Frame ¾ MIB Introduction ¾ Snmp Configuration Outline ¾ Local Engine Snmp Config¾ Remote Engine View Name Snmp ViewMIB Object ID View Type Snmp Group ¾ Group Config ¾ Group Table Snmp User Privacy Password Auth ModeAuth Password Privacy Mode Access ¾ Community ConfigSnmp Community ¾ Community Table Required. On the SNMP→SNMP Config→GlobalRequired. On the SNMP→SNMP Config→SNMP MIB View Notification On the SNMP→SNMP Config→SNMP Retry TimeoutUDP Port User ¾ Rmon Group RmonRmon Group Function History Control Event Config¾ History Control Table ¾ Event Table Alarm Config Rising Event VariableSample Type Rising Threshold 200 ¾ Cluster Role Cluster Neighbor Info 13.1 NDP¾ Introduction to Cluster ¾ Neighbor NDP Summary¾ Neighbor Info NDP ¾ Port Status Displays the port number of the switch Detail ： NDP ConfigAging Time Displays NDP status of the current port Port Displays the port number of the switchNtdp Device Table Ntdp Summary Ntdp Summary Ntdp Interval Time Ntdp ConfigNtdp Hops Cluster EnableCluster Summary ¾ Member Info ¾ Global Config Cluster¾ Cluster Config ¾ Global Cluster 11 Cluster Summary for Member Switch Switch ¾ Current Role Cluster Config¾ Role Change 14 Cluster Configuration for Commander Switch 16 Cluster Configuration for Individual Switch Member Config Member MAC Cluster Topology¾ Create Member Device Name ¾ Graphic Show 18 Collect Topology Application Example for Cluster Function On Cluster→NTDP→NTDP Config page, enable On Cluster→NDP→NDP Config page, enable NDP 220 System Monitor MaintenanceCPU Monitor Memory Monitor 14.2 Log Module ContentLog Table Time Log Buffer ¾ Local Log ConfigLocal Log Remote Log ¾ Log Host Backup LogHost IP ¾ Cable Test ¾ Backup LogDevice Diagnose Cable Test Length ErrorSwitch is available Loopback Test ¾ Ping ConfigNetwork Diagnose Ping Tracert ¾ Tracert Config Hardware Installation System Maintenance via FTPConfigure the Hyper Terminal 232 5Port Settings Download Firmware via bootrom menu TP-LINK upgrade You can only use the port 1 to upgrade TP-LINK ifconfig ip 172.31.70.22 mask 255.255.255.0 gateway TP-LINK start Start User Access Login Appendix a Specifications Configure TCP/IP component Appendix B Configuring the PCs 238 Now Appendix C 802.1X Client Software Installation Guide 241 242 Figure C-7 InstallShield Wizard Complete Uninstall Software Figure C-10 Uninstall Complete Configuration 245 Figure C-15 Connection Status FAQ Appendix D Glossary Ieee 802.1Q Multicast SwitchingGroup Attribute Registration Protocol Garp Ieee 802.1D Link Aggregation Control Protocol Lacp Port AuthenticationRemote Authentication Dial-in User Service Radius Link Aggregation Telnet Simple Network Management Protocol SnmpSimple Network Time Protocol Sntp Spanning Tree Algorithm STA