Building Ip Masks - HP E3800-24G-PoE+-2SFP+ Access Security Manual

Figure 15-6. Analysis of IP Mask for Single-Station Entries
1st 2nd
Octet Octet
IP Mask 255 255
Authorized 10 28
Manager IP

Building IP Masks

The IP Mask parameter controls how the switch uses an Authorized Manager
IP value to recognize the IP addresses of authorized manager stations on your
network.
Configuring One Station Per Authorized Manager IP
Entry
This is the easiest way to apply a mask. If you have ten or fewer management
and/or operator stations, you can configure them by adding the address of
each to the Authorized Manager IP list with 255.255.255.255 for the correspond-
ing mask. For example, as shown in figure 15-3, if you configure an IP address
of 10.28.227.125 with an IP mask of 255.255.255.255, only a station having an IP
address of 10.28.227.125 has management access to the switch.
3rd 4th Manager-Level or Operator-Level Device Access
Octet Octet
255 255 The "255" in each octet of the mask specifies that only the exact value in
that octet of the corresponding IP address is allowed. This mask allows
227 125
management access only to a station having an IP address of 10.33.248.5.
Configuring Multiple Stations Per Authorized Manager
IP Entry
The mask determines whether the IP address of a station on the network meets
the criteria you specify. That is, for a given Authorized Manager entry, the
switch applies the IP mask to the IP address you specify to determine a range
of authorized IP addresses for management access. As described above, that
range can be as small as one IP address (if 255 is set for all octets in the mask),
or can include multiple IP addresses (if one or more octets in the mask are set
to less than 255).
If a bit in an octet of the mask is "on" (set to 1), then the corresponding bit in
the IP address of a potentially authorized station must match the same bit in
the IP address you entered in the Authorized Manager IP list. Conversely, if a
bit in an octet of the mask is "off" (set to 0), then the corresponding bit in the
IP address of a potentially authorized station on the network does not have to
match its counterpart in the IP address you entered in the Authorized Manager
IP list. Thus, in the example shown above, a "255" in an IP Mask octet (all bits
Using Authorized IP Managers
Building IP Masks
15-11