Quick Reference Guide

ProSafe Wireless-N VPN Firewall SRXN3205 Reference Manual
Firewall Security and Content Filtering 5-29
v1.0, January 2010
3. Select the action to be taken on outbound traffic from the listed MAC addresses:
– Block this list and permit all other MAC addresses.
– Permit this list and block all other MAC addresses.
4. Enter a MAC Address in the Add Source MAC Address checkbox and click Add. The MAC
address will appear in the MAC Addresses table. Repeat this process to add additional MAC
addresses.
A valid MAC address is six colon-separated pairs of hexadecimal digits (0 to 9 and a to f). For
example: 01:23:45:ab:cd:ef.
5. Click Apply to save your settings.
You can edit the MAC address by clicking Edit in the Action column adjacent to the MAC
Address.
To remove an entry from the table, select the MAC address entry and click Delete.
To select all the list of MAC addresses, click Select All. A checkmark will appear in the box to the
left of each MAC address in the MAC Addresses table
.
Configuring IP/MAC Address Binding
IP/MAC Binding allows you to bind an IP address to a MAC address and the other way around.
Some devices are configured with static addresses. To prevent users from changing their static IP
addresses, IP/MAC binding must be enabled on the VPN firewall. If the VPN firewall detects
packets with a matching IP address, but with the inconsistent MAC address (or the other way
around), it will drop these packets. If users have enabled the logging option for IP/MAC binding,
these packets will be logged before they are dropped. The VPN firewallwill then display the total
number of dropped packets that violated either the IP-to-MAC binding or the MAC-to-IP binding.
Following is an example:
Assume that three computers on the LAN are set up as follows:
• Host1: MAC address (00:01:02:03:04:05) and IP address (192.168.10.10)
• Host2: MAC address (00:01:02:03:04:06) and IP address (192.168.10.11)
• Host3: MAC address (00:01:02:03:04:07) and IP address (192.168.10.12)
If all the above host entries are added to the IP/MAC Binding table, the following scenarios
indicate the possible outcome.
• Host1: Matching IP and MAC address in the IP/MAC Bindings table.