User Manual

Advanced Configuration
51
3. Configure the Ethernet Protocol Filter Table. This table is pre-populated with existing Ethernet Protocol Filters,
however, you may enter additional filters by specifying the appropriate parameters.
• To add an entry, click Add, and then specify the Protocol Number and a Protocol Name.
— Protocol Number: Enter the protocol number. See http://www.iana.org/assignments/ethernet-numbers
for a list of protocol numbers.
— Protocol Name: Enter related information, typically the protocol name.
• To edit or delete an entry, click Edit and change the information, or select Enable, Disable, or Delete from the
Status drop-down menu.
• An entry’s status must be enabled in order for the protocol to be subject to the filter.
Static MAC
The Static MAC Address filter optimizes the performance of a wireless (and wired) network. When this feature is
properly configured, the AP-600 can block traffic between wired devices and wireless devices based on MAC address.
For example, you can set up a Static MAC filter to prevent wireless clients from communicating with a specific server
on the Ethernet network. You can also use this filter to block unnecessary multicast packets from being forwarded to
the wireless network.
127(
127(127(
127(
The Static MAC Filter is an advanced feature. You may find it easier to control wireless traffic via other filtering
options, such as Ethernet Protocol Filtering.
Each static MAC entry contains the following fields:
• Wired MAC Address
• Wired Mask
• Wireless MAC Address
• Wireless Mask
• Comment: This field is optional.
Each MAC Address or Mask is comprised of 12 hexadecimal digits (0-9, A-F) that correspond to a 48-bit identifier.
(Each hexadecimal digit represents 4 bits (0 or 1).)
Taken together, a MAC Address/Mask pair specifies an address or a range of MAC addresses that the AP-600 will look
for when examining packets. The AP-600 uses Boolean logic to perform an “AND” operation between the MAC
Address and the Mask at the bit level. However, for most users, you do not need to think in terms of bits. It should be
sufficient to create a filter using only the hexadecimal digits 0 and F in the Mask (where 0 is any value and F is the
value specified in the MAC address). A Mask of 00:00:00:00:00:00 corresponds to all MAC addresses, and a Mask of
FF:FF:FF:FF:FF:FF applies only to the specified MAC Address.
For example, if the MAC Address is 00:20:A6:12:54:C3 and the Mask is FF:FF:FF:00:00:00, the AP-600 will examine
the source and destination addresses of each packet looking for any MAC address starting with 00:20:A6. If the Mask
is FF:FF:FF:FF:FF:FF, the AP-600 will only look for the specific MAC address (in this case, 00:20:A6:12:54:C3).
When creating a filter, you can configure the Wired parameters only, the Wireless parameters only, or both sets of
parameters. Which parameters to configure depends upon the traffic that you want block:
– To prevent all traffic from a specific wired MAC address from being forwarded to the wireless network, configure
only the Wired MAC Address and Wired Mask (leave the Wireless MAC Address and Wireless Mask set to all
zeros).
– To prevent all traffic from a specific wireless MAC address from being forwarded to the wired network, configure
only the Wireless MAC address and Wireless Mask (leave the Wired MAC Address and Wired Mask set to all
zeros).
– To block traffic between a specific wired MAC address and a specific wireless MAC address, configure all four
parameters.
To create an entry, click Add and enter the appropriate MAC addresses and Masks to setup a filter. The entry is
enabled automatically when saved. To edit an entry, click Edit. To disable or remove an entry, click Edit and change
the Status field from Enable to Disable or Delete.