Manuals / TP-Link / Computer Equipment / Switch

TP-Link TL-SL5428E manual ¾ ARP Detect, ¾ Trusted Port

Models: TL-SL5428E

1 259

Download 259 pages 46.72 Kb

Page 177

The IP-MAC Binding function allows the switch to bind the IP address, MAC address, VLAN ID and the connected Port number of the Host together when the Host connects to the switch. Basing on the predefined IP-MAC Binding entries, the ARP Inspection functions to detect the ARP packets and filter the illegal ARP packet so as to prevent the network from ARP attacks.

The ARP Inspection function is implemented on the ARP Detect, ARP Defend and ARP Statistics pages.

11.2.1 ARP Detect

ARP Detect feature enables the switch to detect the ARP packets basing on the bound entries in the IP-MAC Binding Table and filter the illegal ARP packets, so as to prevent the network from ARP attacks, such as the Network Gateway Spoofing and Man-In-The-Middle Attack, etc.

Choose the menu Network Security→ARP Inspection→ARP Detect to load the following page.

Figure 11-13 ARP Detect

The following entries are displayed on this screen:

¾ARP Detect

ARP Detect:Enable/Disable the ARP Detect function, and click the Apply

button to apply.

¾Trusted Port

Trusted Port:Select the port for which the ARP Detect function is unnecessary

as the Trusted Port. The specific ports, such as up-linked port, routing port and LAG port, should be set as Trusted Port. To ensure the normal communication of the switch, please configure the ARP Trusted Port before enabling the ARP Detect function.

169

Image 177

TP-Link TL-SL5428E manual ¾ ARP Detect, ¾ Trusted Port

Contents

Rev 1910010529 Copyright & Trademarks Contents Gvrp TC Protect 101 11.4.1 Ntdp 11.4.2VII Package Contents Intended Readers About this GuideConventions Overview of This GuidePath Switch, which facilitates you to monitor the Igmp messages Return to Contents Overview of the Switch Main FeaturesIntroduction Appearance Description Front Panel¾ LEDs Name Status Indication Rear Panel Login to the Switch LoginConfiguration Return to Contents System Info SystemSystem Summary ¾ Port StatusPort ¾ Port InfoType RateDevice Description ¾ Bandwidth Utilization¾ Device Description ¾ Time Config System Time¾ Time Info System IP User Table User Manage¾ User Info User ConfigPassword Config RestoreConfirm Password Retype the password User ID, Name, Access Level and status OperationConfig Backup Firmware Upgrade¾ Config Backup System Reset System RebootAccess Control Access Security¾ Session Config ¾ Access Control ConfigIP Address&Mask MAC Address¾ Access User Number SSL Config¾ Global Config SSH Config¾ Certificate Download ¾ Key DownloadIdle Timeout ProtocolMax Connect Key Type ¾ Configuration ProcedureDownload ¾ Network RequirementsApplication Example 2 for SSH Page Return to Contents Port Config SwitchingPort Port SelectDescription Port MirrorSpeed and Duplex Flow Control¾ Mirrored Port ¾ Mirroring PortIngress Egress¾ Port Security Port SecurityPort Isolation Max Learned MACLearned Num Forward Portlist Select the port that to be forwarded to ¾ Port Isolation Config¾ Port Isolation List Forward Portlist Display the forwardlistLAG Table LAG¾ LAG Table Aggregate ArithmeticGroup Number MemberStatic LAG ¾ LAG ConfigLAG will delete this LAG Lacp ConfigAdmin Key ¾ Lacp ConfigSystem Priority Port PriorityTraffic Monitor Traffic Summary¾ Auto Refresh Traffic Statistics MAC Address Relationship Type Configuration Way Aging outBound Address and the port¾ Address Table ¾ Search OptionStatic Address MAC Address Displays the MAC address learned by the switchDisplays the corresponding Vlan ID of the MAC address ¾ Create Static Address¾ Static Address Table Dynamic Address¾ Dynamic Address Table ¾ Aging ConfigBind Filtering Address¾ Filtering Address Table ¾ Create Filtering AddressVlan implementation Vlan¾ Link Types of ports 802.1Q Vlan¾ Pvid Vlan ConfigVlan ID Select ¾ Vlan TableDescription ： Members Operation ：Enter the ID number of Vlan ¾ Vlan ConfigIs valid or not ¾ Vlan MembersPort Displays the port number ¾ Vlan Port ConfigRequired. On the VLAN→802.1Q VLAN→VLAN Config Required. On the VLAN→802.1Q VLAN→Port Config page, set¾ Vlan of Port Vlan DescriptionMAC Vlan Optional. On the VLAN→802.1Q VLAN→VLAN ConfigPort Enable ¾ MAC Vlan TableMAC Select Protocol Vlan Required. On the VLAN→MAC VLAN→Port EnableProtocol Template Protocol Vlan¾ Create Protocol Vlan ¾ Protocol Vlan Table¾ Protocol Template Table ¾ Create Protocol TemplateApplication Example for 802.1Q Vlan Required. On VLAN→802.1Q VLAN→VLAN Config page, create a Required. On VLAN→802.1Q VLAN→Port Config page, configureApplication Example for MAC Vlan Operation Description¾ Network Diagram ¾ Configuration Procedure Application Example for Protocol Vlan Required. On VLAN→Protocol VLAN→Protocol Template Protocol type Value On VLAN→Protocol VLAN→Protocol Vlan page, create protocolVPN Config Vlan Mapping¾ VPN Up-link Ports ¾ Vlan Mapping Table ¾ Vlan Mapping ConfigOptional. On the VLAN→VLAN VPN→VPN Config Required. On the VLAN→VLAN VPN→VPN ConfigRequired. On the VLAN→VLAN VPN→Port Enable Required. On the VLAN→VLAN VPN→VLAN Mapping¾ Garp Gvrp¾ Gvrp Select Port Status Registration Mode ¾ Port ConfigPrivate Vlan Configuration Procedure¾ Features of Private Vlan ¾ The Elements of a Private Vlan¾ Private Vlan Implementation Pvid ¾ Packet forwarding in Private Vlan Pvlan ¾ Private Vlan Table ¾ Create Private VlanPrimary Vlan Secondary VlanRequired. On the VLAN→Private VLAN→Port Configure Port Select the desired port for configuration Port Type¾ Private Vlan Port Table Required. On the VLAN→Private VLAN→PVLANApplication Example for Private Vlan Required. On the VLAN→802.1Q VLAN→VLAN Config page, click ¾ STP Elements Spanning Tree¾ Bpdu Comparing Principle in STP mode ¾ STP TimersStep Operation ¾ STP GenerationTips： ¾ Rstp Elements¾ Mstp Elements ¾ Port Roles ¾ Port StatesSTP Config STP ConfigVersion Forward DelayHello Time Max AgeSTP Summary STP Summary Port ConfigExtPath PriorityIntPath Edge PortMstp Instance Region ConfigPort Role Port Status¾ Region Config Instance Config¾ Instance Table Instance Port ConfigInstance ClearPath Cost Instance IDPort Protect STP Security¾ TC Protect ¾ Bpdu Protect¾ Bpdu Filter Root Protect Loop ProtectTC Protect Bpdu Protect11 TC Protect TC ProtectOn Spanning Tree→STP Config→Port Config On Spanning Tree→STP Config→STP ConfigApplication Example for STP Function On Spanning Tree→MSTP Instance→InstanceBridge of Instance Configure Switch D ¾ Suggestion for Configuration Multicast ¾ Multicast Overview¾ Multicast Address Multicast IP Port ¾ Multicast Address Table¾ Igmp Snooping Igmp Snooping¾ Igmp Snooping Process ¾ Igmp Messages¾ Igmp Snooping Fundamentals Snooping ConfigDescription Displays Igmp Snooping status Member ¾ Igmp Snooping StatusFast Leave Igmp SnoopingMember Port Time Router Port TimeLeave Time Static Router PortMulticast→IGMP Snooping→VLAN Config Snooping→Snooping Config and Port ConfigMulticast Vlan Router Port¾ Multicast Vlan Application Example for Multicast Vlan On the Multicast→IGMP Snooping→Snooping ConfigVlan Multicast→IGMP Snooping→Multicast VlanSnooping→Port Config ¾ Configuration Procedure Step Operation DescriptionSnooping→Snooping Config Multicast IPStatic Multicast IP Multicast IP Table¾ Static Multicast IP Table ¾ Create Static MulticastIP-Range Multicast FilterPort Filter ¾ Port Filter ConfigPacket Statistics Multicast→Multicast Filter→IP-RangeMulticast→Multicast Filter→Port Filter ¾ Igmp Statistics ¾ Priority Mode QoS¾ QoS 802.1Q frame ¾ Schedule ModeSP-Mode DiffServ ¾ Port Priority ConfigPort Priority Displays the LAG number which the port belongs to¾ Schedule Mode Config Schedule Mode¾ 802.1P Priority Config 3 802.1P Priority¾ Priority Level Dscp Priority It ranges from 0 to ¾ Dscp Priority ConfigPriority Level Priority levels are labeled as TC0, TC1, TC2 and TC3¾ Rate Limit Config Bandwidth ControlRate Limit Storm Control Ingress Rate bpsEgress Ratebps Broadcast Rate ¾ Storm Control ConfigBps Multicast Rate¾ Port Voice Vlan Mode Voice VlanNumber OUI Address Vendor Packet Type Processing Mode ¾ Security Mode of Voice Vlan12 Global Configuration Global Config13 Port Config Port ModeOUI Config Optional. On QoS→Voice VLAN→OUI Config page, you Required. On VLAN→802.1Q VLAN→Port ConfigRequired. On QoS→Voice VLAN→Port Config Required. On QoS→Voice VLAN→Global ConfigTime-Range ACLTime-Range Summary IndexTime-Range Create Holiday Config ACL Config¾ Create Holiday ¾ Holiday TableACL Create ACL Summary¾ Rule Table ¾ Create ACL¾ Create MAC ACL MAC ACLRule ID EtherType¾ Create Standard-IP ACL Standard-IP ACLFragment Mask¾ Create Extend-IP ACL Extend-IP ACLPolicy Summary Policy ConfigAction Create Policy CreateSelect Policy Desired policy, please click the Delete button¾ Create Action 11 Action CreateBinding Table Policy BindingPort Binding ¾ Policy Bind TableVlan Binding Direction Displays the binding directionEnter the ID of the Vlan you want to bind ¾ VLAN-Bind Table Application Example for ACLOn ACL→ACL Config→ACL Create page, create ACL On ACL→ACL Config→Standard-IP ACL page, select ACL IP-MAC Binding Network SecurityManual Binding Enter the Vlan ID ¾ Manual Binding OptionProtect Type Select the Protect Type for the entry ¾ Manual Binding TableARP Scanning Start IP Address Dhcp SnoopingEnd IP Address Scan¾ Dhcp Working Principle Network diagram for DHCP-snooping implementation¾ Option ¾ Dhcp Cheating Attack Dhcp Cheating Attack Implementation Procedure163 ¾ Port Config Port Select ¾ Option 82 ConfigDecline Threshold Decline Flow Control Customization Circuit ID Remote IDARP Inspection ¾ Imitating Gateway¾ Cheating Gateway ¾ Cheating Terminal Hosts 10 ARP Attack Cheating Gateway¾ Man-In-The-Middle Attack ¾ ARP Flooding Attack ARP Detect ¾ ARP Detect¾ Trusted Port ARP Defend Required. On the Network Security→IP-MACNetwork Security→ARP ¾ ARP Defend ARP StatisticsDefend Speed¾ Illegal ARP Packet IP Source GuardDoS Defend ¾ IP Source Guard ConfigDoS Attack Type Description DoS Detect DoS DefendDetect Time 11.5Detect Attack Type¾ 802.1X Authentication Procedure ¾ The Mechanism of an 802.1X Authentication System178 179 ¾ Guest Vlan ¾ 802.1X Timer802.1X Authentication MethodGuest Vlan Guest Vlan IDSupplicant Timeout Server TimeoutRetry Times Radius Server Control ModeControl Type Authorized802.1X Client Software On the Network Security→802.1X→Global ConfigRequired. On the Network Security→802.1X→Radius Required. On the Network Security→802.1X→Port¾ Snmp Overview Snmp¾ Snmp Management Frame ¾ Snmp Versions¾ MIB Introduction ¾ Snmp Configuration OutlineSnmp Config ¾ Local Engine¾ Remote Engine MIB Object ID Snmp ViewView Type View NameSnmp Group ¾ Group Config¾ Group Table Snmp UserAuth Password Auth ModePrivacy Mode Privacy Password¾ Community Config AccessSnmp Community Required. On the SNMP→SNMP Config→SNMP Required. On the SNMP→SNMP Config→GlobalMIB View ¾ Community TableNotification On the SNMP→SNMP Config→SNMPUDP Port TimeoutUser RetryRmon ¾ Rmon GroupRmon Group Function Event Config History Control¾ History Control Table ¾ Event Table Alarm ConfigSample Type VariableRising Threshold Rising Event200 ¾ Cluster Role Cluster13.1 NDP Neighbor Info¾ Introduction to Cluster NDP Summary ¾ Neighbor¾ Neighbor Info NDP ¾ Port Status Displays the port number of the switchNDP Config Detail ：Aging Time Ntdp Port Displays the port number of the switchDevice Table Displays NDP status of the current portNtdp Summary Ntdp Summary Ntdp Config Ntdp Interval TimeNtdp Hops Enable ClusterCluster Summary ¾ Cluster Config ¾ Global Config Cluster¾ Global Cluster ¾ Member Info11 Cluster Summary for Member Switch SwitchCluster Config ¾ Current Role¾ Role Change 14 Cluster Configuration for Commander Switch 16 Cluster Configuration for Individual Switch Member Config¾ Create Member Cluster TopologyDevice Name Member MAC¾ Graphic Show 18 Collect TopologyApplication Example for Cluster Function On Cluster→NTDP→NTDP Config page, enable On Cluster→NDP→NDP Config page, enable NDP220 Maintenance System MonitorCPU Monitor Memory Monitor 14.2 Log Log Table ContentTime ModuleLocal Log ¾ Local Log ConfigRemote Log Log BufferBackup Log ¾ Log HostHost IP Device Diagnose ¾ Backup LogCable Test ¾ Cable TestSwitch is available ErrorLoopback LengthNetwork Diagnose ¾ Ping ConfigPing TestTracert ¾ Tracert ConfigSystem Maintenance via FTP Hardware InstallationConfigure the Hyper Terminal 232 5Port Settings Download Firmware via bootrom menuTP-LINK upgrade You can only use the port 1 to upgrade TP-LINK ifconfig ip 172.31.70.22 mask 255.255.255.0 gatewayTP-LINK start Start User Access Login Appendix a Specifications Configure TCP/IP component Appendix B Configuring the PCs238 Now Appendix C 802.1X Client Software Installation Guide241 242 Figure C-7 InstallShield Wizard Complete Uninstall SoftwareFigure C-10 Uninstall Complete Configuration245 Figure C-15 Connection Status FAQ Appendix D Glossary Group Attribute Registration Protocol Garp Multicast SwitchingIeee 802.1D Ieee 802.1QRemote Authentication Dial-in User Service Radius Port AuthenticationLink Aggregation Link Aggregation Control Protocol LacpSimple Network Time Protocol Sntp Simple Network Management Protocol SnmpSpanning Tree Algorithm STA Telnet