Cpu Interface Filtering - D-Link DES-3326SRM - Switch - Stackable Product Manual

CPU Interface Filtering

There are specific circumstances under which the ACL cannot filter a packet even when there is a condition match that should
deny forwarding. This is a limitation that may arise if:
•
the destination MAC is the same as the Switch (system) MAC
•
a packet is directed to the system IP interface such as multicast IP packets or if the hardware IP routing table is full
and Switch software routes the packet according to routing protocol.
In order to address this functional limitation of the chip set, an additional function, CPU Interface Filtering, has been added.
CPU Filtering may be universally enabled or disabled. Setting up CPU Interface Filtering follows the same basic procedure as
ACL configuration and requires some of the same input parameters.
CPU Interface Filtering is configured in a manner similar to creating an Access Profiles. First a mask is created to specify
which part or parts of a frame the Switch will examine, such as the MAC source address or the IP destination address. Then
rules are used to define criteria the Switch will use to determine what to do with the frame. The entire process is described
below.
CPU Interface Filtering State Settings
In the following window, the user may globally enable or disable the CPU Interface Filtering mechanism by using the pull-
down menu to change the running state. To access this window, click CPU Interface Filtering State in the Advanced Setup
directory folder. Choose Enabled to enable CPU packets to be scrutinized by the Switch and Disabled to disallow this
scrutiny.
D-Link DES-3326S Layer 3 Switch
Figure 14- 7. CPU Interface Filtering State Settings window
85