Shenzhou Digital switch uses MAC-IP access control list function to realize the binding of multiple Mac-ip under single port

Source: Internet
Author: User
Tags floor division

Shenzhou Digital switch uses MAC-IP access control list function to realize the binding of multiple Mac-ip under single port

1. Description:

A company office network, the core switch for the digital Shenzhou dcrs-5950-28t, according to the office floor division of several VLANs, for each floor divided into different IP segment and set the gateway. Interface Ethernet 1/18-20 for access port, 18-Port-owned VlanID1021, the ports are connected to each floor of the non-network management switch as the Office PC Access switch.

2. Demand:

Customer requirements from the core switch Ethernet 1/18 MAC-IP binding, to avoid the group PC unauthorized change IP address, but also can play a limited personal PC access to the Internet role.

3, Implementation methods:

Method One: Using the MAC-IP Access Extension list feature (only for ETHERNET1/18 configuration, the other port configuration is the same)

Global Mode configuration

dcrs-5950-28t (config) #firewall enable   //Open firewall feature
dcrs-5950-28t (config) #mac-ip-access-list Extended test    //Configuration extension list, name is test                                                                
dcrs-5950-28t (config-macip-ext-nacl-test) #permit host-source-mac 40-16-9f-ea-26-71 any-destination-mac IP Host-source 16.202.2.220 any-destination   //Configure allowed access MAC-IP address (configurable multiple)
dcrs-5950-28t ( config-macip-ext-nacl-test) #deny any-source-mac any-destination-mac IP any-source any-destination    Prohibit access command (This command must be last)
dcrs-5950-28t (config-macip-ext-nacl-test) #exit    //Exit to Global mode
Port mode configuration

dcrs-5950-28t (config) #int Ethernet 1/18//Enter interface E1/18

dcrs-5950-28t (CONFIG-IF-ETHERNET1/18) # MAC-IP Access-group Test in//interface application Test List
dcrs-5950-28t (CONFIG-IF-ETHERNET1/18) #exit//exit to Global mode

Figure 1:

Figure 2:

Figure 3:

Supplementary Note: List can write a number of, write a list first write permission to pass the MAC-IP, and finally write a full ban, similar to the style of firewall strategy, it should be noted that all prohibited orders must be written in the end.

In addition, the maximum number of lists is not tested, how many unknowns can be written, depending on the size of the ACL access control list limit, but to be sure, this list is much more than the Mac-ip-pool feature of AM function can write.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.