Ip Security - Paradyne BitStorm 4800 User Manual

A. CLI Command Descriptions

IP Security

Entries in the table of allowed IP addresses are made in one of two ways:
T
T
Entries in this table are used for two functions:
T
T
When IP Security is enabled for a DSL port, the restrictions on upstream data flow
described above are enforced. In addition to restricting communication to only
those addresses that are in the table, a maximum can be set on the number of
addresses that can be in use on a port. This number is the sum of the static and
dynamic entries for that port. If the limit is reached, the unit will block all requests
for allocation of additional addresses via DHCP. This condition remains until one of
the following happens:
T
T
T
T
T
A-38
Dynamic entries are automatically learned by the unit by monitoring DHCP
messages that pass through the unit between a subscriber's host and a DHCP
server. Learning of dynamic entries in this manner is always active. Dynamic
entries are not retained in non-volatile storage so they are lost when the unit is
reset or loses power. Dynamic entries are removed if and when the lease on
the DHCP-provided address expires or when the host relinquishes its lease on
the address.
Static entries are entered by an administrator using the
. Static entries are saved in non-volatile storage and can only be
add command
removed by administrator action.
If the bridge mode is configured for multiplexing, entries in the table control the
flow of hardware (MAC) address information via ARP requests and responses
passing through the unit.
If the unit is configured for multiplexing and there is not an entry in this table
for a subscriber's host, that host will not be able to obtain MAC address
information for other hosts on the subnet via the BitStorm 4800. In addition,
hosts that are connected on the upstream side of the unit will not be able to
obtain MAC information for this subscriber's host. (A host that is connected on
the DSL side of the unit cannot obtain MAC address information about any
host other than the port's Next Hop Router when the unit is configured for
multiplexing.)
For typical TCP/IP communications, the inability to obtain MAC address
information effectively blocks communications. However, it may have no effect
at all on other protocols (such as PPPoE) that do not require the MAC address
information that is obtained via ARP messages.
If IP Security is enabled for a DSL port, the unit drops all messages that are
received at that port whose Ethertype is not either ARP or IP and whose
source IP address is not found in the IP address table.
The lease on an existing dynamic entry for this port expires
A subscriber's host connected to this port releases its DHCP-assigned
address
One or more entries are deleted from the table by an administrator
The limit on the number of entries is increased
IP Security is disabled on the port
July 2002
configure security ip
4800-A2-GB20-10