Network Router User Manual

Chapter 20: Security Configuration Guide
282 SmartSwitch Router User Reference Manual
Configuring Layer-2 Secure Port Filters
Secure port filters block access to a specified port. You can use a secure port filter by itself
to secure unused ports. Secure port filters can be configured as source or destination port
filters. A secure port filter applied to a source port forces all incoming packets to be
dropped on a port. A secure port filter applied to a destination port prevents packets from
going out a certain port.
You can combine secure port filters with static entries in the following ways:
• Combine a source secure port filter with a source static entry to drop all received traffic
but allow any frame coming from specific source MAC address to go through
• Combine a source secure port filter with a flow static entry to drop all received traffic
but allow any frame coming from a specific source MAC address that is destined to
specific destination MAC address to go through
• Combine a destination secure port with a destination static entry to drop all received
traffic but allow any frame destined to specific destination MAC address go through
• Combine a destination secure port filter with a flow static entry to drop all received
traffic but allow any frame coming from specific source MAC address that is destined
to specific destination MAC address to go through
To configure Layer-2 secure port filters, enter the following commands in Configure
mode:
Configure a source secure port
filter.
filters add secure-port name <name>
direction source vlan
<VLAN-num>
in-port-list
<port-list>
Configure a destination secure
port filter.
filters add secure-port name <name>
direction destination vlan
<VLAN-num>
in-port-list
<port-list>