Shenzhou Digital switch uses MAC-IP access control list function to realize the binding of multiple Mac-ip under single port

Shenzhou Digital switch uses MAC-IP access control list function to realize the binding of multiple Mac-ip under single port

1. Description:

A company office network, the core switch for the digital Shenzhou dcrs-5950-28t, according to the office floor division of several VLANs, for each floor divided into different IP segment and set the gateway. Interface Ethernet 1/18-20 for access port, 18-Port-owned VlanID1021, the ports are connected to each floor of the non-network management switch as the Office PC Access switch.

2. Demand:

Customer requirements from the core switch Ethernet 1/18 MAC-IP binding, to avoid the group PC unauthorized change IP address, but also can play a limited personal PC access to the Internet role.

3, Implementation methods:

Method One: Using the MAC-IP Access Extension list feature (only for ETHERNET1/18 configuration, the other port configuration is the same)

Global Mode configuration

dcrs-5950-28t (config) #firewall enable   //Open firewall feature
dcrs-5950-28t (config) #mac-ip-access-list Extended test    //Configuration extension list, name is test                                                                
dcrs-5950-28t (config-macip-ext-nacl-test) #permit host-source-mac 40-16-9f-ea-26-71 any-destination-mac IP Host-source 16.202.2.220 any-destination   //Configure allowed access MAC-IP address (configurable multiple)
dcrs-5950-28t ( config-macip-ext-nacl-test) #deny any-source-mac any-destination-mac IP any-source any-destination    Prohibit access command (This command must be last)
dcrs-5950-28t (config-macip-ext-nacl-test) #exit    //Exit to Global mode
Port mode configuration

dcrs-5950-28t (config) #int Ethernet 1/18//Enter interface E1/18

dcrs-5950-28t (CONFIG-IF-ETHERNET1/18) # MAC-IP Access-group Test in//interface application Test List
dcrs-5950-28t (CONFIG-IF-ETHERNET1/18) #exit//exit to Global mode

Figure 1:

Figure 2:

Figure 3:

Supplementary Note: List can write a number of, write a list first write permission to pass the MAC-IP, and finally write a full ban, similar to the style of firewall strategy, it should be noted that all prohibited orders must be written in the end.

In addition, the maximum number of lists is not tested, how many unknowns can be written, depending on the size of the ACL access control list limit, but to be sure, this list is much more than the Mac-ip-pool feature of AM function can write.