General Security Measures - Samsung iES4028F Management Manual

3
Configuring the Switch
CLI – This example allows SNMP access for a specific client.
Console(config)#management snmp-client 10.1.2.3
Console(config)#end
Console#show management all-client
Management IP Filter
HTTP-Client:
Start IP address
-----------------------------------------------
SNMP-Client:
Start IP address
-----------------------------------------------
1. 10.1.2.3
TELNET-Client:
Start IP address
-----------------------------------------------
Console#

General Security Measures

This switch supports many methods of segregating traffic for clients attached to
each of the data ports, and for ensuring that only authorized clients gain access to
the network. Private VLANs and port-based authentication using IEEE 802.1X are
commonly used for these purposes. In addition to these methods, several other
options of providing client security are supported by this switch. These include
port-based authentication, which can be configured for network client access
by specifying a fixed set of MAC addresses. The addresses assigned to DHCP
clients can also be carefully controlled using static or dynamic bindings with the IP
Source Guard and DHCP Snooping commands.
This switch provides client security using the following options:
• Private VLANs – Provide port-based security and isolation between ports within the
assigned VLAN. (See "Private VLANs" on page 3-209.)
• Port Security – Configure secure addresses for individual ports.
• 802.1X – Use IEEE 802.1X port authentication to control access to specific ports.
(See "Configuring 802.1X Port Authentication" on page 3-88.)
• Web Authentication - Allows stations to authenticate and access the network in
situations where 802.1X or Network Access authentication methods are infeasible
or impractical.
• Network Access - Configures MAC authentication and dynamic VLAN assignment.
• ACL - Access Control Lists provide packet filtering for IP frames (based on
address, protocol, Layer 4 protocol port number or TCP control code) or any
frames (based on MAC address or Ethernet type).
• DHCP Snooping – Filters IP traffic on unsecure ports for which the source address
cannot be identified via DHCP snooping nor static source bindings. (See "DHCP
Snooping" on page 3-116.)
3-96
End IP address
End IP address
10.1.2.3
End IP address
4-146