Management Guide - Kamery IP

General Security Measures3General Security MeasuresThis switch supports many methods of segregating traffic for clients attached toeach of the data ports, and for ensuring that only authorized clients gain access tothe network. Private VLANs and port-based authentication using IEEE 802.1X arecommonly used for these purposes. In addition to these methods, several otheroptions of providing client security are supported by this switch. These includeport-based authentication, which can be configured for network client accessby specifying a fixed set of MAC addresses. The addresses assigned to DHCPclients can also be carefully controlled using static or dynamic bindings with the IPSource Guard and DHCP Snooping commands.This switch provides client security using the following options:• Private VLANs – Provide port-based security and isolation between ports within theassigned VLAN. (See “Private VLANs” on page 3-240.)• Port Security – Configure secure addresses for individual ports.• 802.1X – Use IEEE 802.1X port authentication to control access to specific ports.(See “Configuring 802.1X Port Authentication” on page 3-99.)• Web Authentication - Allows stations to authenticate and access the network insituations where 802.1X or Network Access authentication methods are infeasibleor impractical.• Network Access - Configures MAC authentication and dynamic VLAN assignment.• ACL - Access Control Lists provide packet filtering for IPv4 frames (based onaddress, protocol, Layer 4 protocol port number or TCP control code), IPv6 frames(based on address, next header type, or flow label), or any frames (based on MACaddress or Ethernet type).• ARP Inspection – Security feature that validates the MAC Address bindings forAddress Resolution Protocol packets. Provides protection against ARP traffic withinvalid MAC to IP Address bindings, which forms the basis for certain“man-in-the-middle” attacks.• DHCP Snooping – Filters IP traffic on insecure ports for which the source addresscannot be identified via DHCP snooping. (See “DHCP Snooping” on page 3-143.)• IP Source Guard – Filters untrusted DHCP messages on insecure ports by buildingand maintaining a DHCP snooping binding table. (See “IP Source Guard” on page3-150.)Note: The priority of execution for the filtering commands is Port Security, PortAuthentication, Network Access, Web Authentication, Access Control Lists, IPSource Guard, and then DHCP Snooping.3-109