Cpu Interface Filtering - D-Link DES-3528 User Manual

xStack DES-3528 Series Layer 2 Stackable Fast Ethernet Managed Switch User Manual
Time Range Name
Counter
Ports
Click Apply to display the following Access Rule List window.
To view the configurations for previously configured rule click on the corresponding Show Details Button which will
display the following Access Rule Details window.

CPU Interface Filtering

Due to a chipset limitation and needed extra switch security, the Switch incorporates CPU Interface filtering. This
added feature increases the running security of the Switch by enabling the user to create a list of access rules for
packets destined for the Switch's CPU interface. Employed similarly to the Access Profile feature previously
mentioned, CPU interface filtering examines Ethernet, IP and Packet Content Mask packet headers destined for the
CPU and will either forward them or filter them, based on the user's implementation. As an added feature for the CPU
Filtering, the Switch allows the CPU filtering mechanism to be enabled or disabled globally, permitting the user to
create various lists of rules without immediately enabling them.
Creating an access profile for the CPU is divided into two basic parts. The first is to specify which part or parts of a
frame the Switch will examine, such as the MAC source address or the IP destination address. The second part is
entering the criteria the Switch will use to determine what to do with the frame. The entire process is described below.
tick the No Limit check box. The default setting is No Limit.
Tick the check box and enter the name of the Time Range settings that has been previously
configured in the Time Range Settings window. This will set specific times when this
access rule will be implemented on the Switch.
Enable or disable the counter settings.
When a range of ports is to be configured, the Auto Assign check box MUST be ticked in the
Access ID field of this window. If not, the user will be presented with an error message and
the access rule will not be configured. Ticking the All Ports check box will denote all ports on
the Switch.
Figure 10- 26. Access Rule List (Packet Content)
Figure 10- 2 . Access Rule Detail Information (Packet Content) 7
NOTE: Address Resolution Protocol (ARP) is the standard for finding a
host's hardware address (MAC Address). However, ARP is vulnerable as
it can be easily spoofed and utilized to attack a LAN. For a more detailed
explanation on how ARP works and how to employ D-Link's advanced
unique Packet Content ACL to prevent ARP spoofing attack, please see
Appendix B, at the end of this manual.
190