H3C S5510 Series Manuale utente
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Table of Contents
i
Table of Contents
Chapter 1 MAC-IP-Port Binding Configuration ..........................................................................1-1
1.1 MAC-IP-Port Binding Overview .........................................................................................1-1
1.2 Configuring MAC-IP-Port Binding......................................................................................1-1
1.3 Displaying and Maintaining MAC-IP-Port Binding.............................................................1-2
1.4 MAC-IP-Port Binding Configuration Example....................................................................1-2
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Chapter 1 MAC-IP-Port Binding Configuration
1-1
Chapter 1 MAC-IP-Port Binding Configuration
1.1 MAC-IP-Port Binding Overview
MAC-IP-port binding allows a device to filter packets and thus enhance security. With
MAC-IP-port binding configured, a port checks whether the source MAC and IP
addresses of an inbound packet is identical to the configured MAC-to-IP binding on the
port. If so, it forwards the packet; otherwise, it discards the packet.
1.2 Configuring MAC-IP-Port Binding
Follow these steps to configure MAC-IP-port binding:
To do… Use the command… Remarks
Enter system view system-view —
Bind a MAC-IP
address pair to
multiple ports
user-bind mac-addr mac-address
ip-addr ip-address interface
interface-list
interface interface-type
interface-number
Configu
re
MAC-IP
-port
binding
Bind a MAC-IP
address pair to
the current
port user-bind mac-addr mac-address
ip-addr ip-address
Required
Use either
approach.
Caution:
zThe port in an aggregation group does not support MAC-IP-Port binding
configuration.
zS3610&S5510 Series Ethernet Switches differentiate binding through “MAC
address + IP address + port”. You can bind a MAC address with only one IP address
and vice versa. However, you can bind a MAC-IP pair to multiple ports.
zMAC-IP-port binding is on a per-port basis, that is, a port with MAC-IP-port binding
enabled filters packets independently; it does not affect any other port.
zThe MAC address to be bound cannot be all 0s, all Fs, or a multicast address. The
IP address can only be a Class A, Class B, or Class C address and can neither be
127.x.x.x nor 0.0.0.0.
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Chapter 1 MAC-IP-Port Binding Configuration
1-2
1.3 Displaying and Maintaining MAC-IP-Port Binding
To do… Use the command… Remarks
Display the MAC-IP-port binding
entries configured on all ports display user-bind
Display the MAC-IP-port binding
entries configured on all ports for a
specified MAC address
display user-bind
mac-addr mac-address
Display the MAC-IP-port binding
entries configured on all ports for a
specified IP address
display user-bind
ip-addr ip-address
Display the MAC-IP-port binding
entries configured on specified ports display user-bind
interface interface-list
Available in
any view
1.4 MAC-IP-Port Binding Configuration Example
I. Network Requirements
As shown in Figure 1-1, switches LSAand LSB and data terminals DT1, DT2, and DT3
are on an Ethernet. DT1 and DT2 are connected to ports Ethernet 1/0/4 and Ethernet
1/0/5 of LSB respectively, DT3 is connected to port Ethernet 1/0/4 of LSA, while LSB is
connected to port Ethernet 1/0/5 of LSA.
Detailed requirements are as follows:
zOn port Ethernet 1/0/4 of LSA, only IP packets with the source MAC address of
00-01-02-03-04-05 and the source IP address of 192.168.0.3 can pass.
zOn port Ethernet 1/0/5 of LSA, only IP packets with the source MAC address of
00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.
zOn port Ethernet 1/0/4 of LSB, only IP packets with the source MAC address of
00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.
zOn port Ethernet 1/0/5 of LSB, only IP packets with the source MAC address of
00-01-02-03-04-07 and the source IP address of 192.168.0.2 can pass.
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Chapter 1 MAC-IP-Port Binding Configuration
1-3
II. Network Diagram
PC
PC
PC
LSA
LSB DT3
MAC0
IP192
to inte
DT2
MAC00-01-02-03-04-
IP192.168.0.2
to interface Ethernet
DT1
MAC00-01-02-03-04-06
IP 192.168.0.1
to interface Ethernet1/0/4
Ethernet1/0/4 Ethernet1/0/5
Ethernet1/0/5 Ethernet1/0/4
0-01-02-03-04-05
.168.0.3
rface Ethernet1/0/4
07
1/0/5
PC
PC
PC
LSA
LSB DT3
MAC0
IP192
to inte
DT2
MAC00-01-02-03-04-
IP192.168.0.2
to interface Ethernet
DT1
MAC00-01-02-03-04-06
IP 192.168.0.1
to interface Ethernet1/0/4
Ethernet1/0/4 Ethernet1/0/5
Ethernet1/0/5 Ethernet1/0/4
0-01-02-03-04-05
.168.0.3
rface Ethernet1/0/4
07
1/0/5
PC
PC
PC
LSA
LSB DT3
MAC0
IP192
to inte
DT2
MAC00-01-02-03-04-
IP192.168.0.2
to interface Ethernet
DT1
MAC00-01-02-03-04-06
IP 192.168.0.1
to interface Ethernet1/0/4
Ethernet1/0/4 Ethernet1/0/5
Ethernet1/0/5 Ethernet1/0/4
0-01-02-03-04-05
.168.0.3
rface Ethernet1/0/4
07
1/0/5
g
Figure 1-1 Network diagram for MAC-IP-port bindin
III. Configuration Procedure
1) Configure LSA
# Configure port Ethernet 1/0/4 of LSA to allow only IP packets with the source MAC
address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 to pass.
<Sysname> system-view
[Sysname] interface ethernet 1/0/4
[Sysname-Ethernet1/0/4] user-bind mac-addr 0001-0203-0405 ip-addr
192.168.0.3
[Sysname-Ethernet1/0/4] quit
# Configure port Ethernet 1/0/5 of LSA to allow only IP packets with the source MAC
address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.
[Sysname] interface ethernet 1/0/5
[Sysname-Ethernet1/0/5] user-bind mac-addr 0001-0203-0406 ip-addr
192.168.0.1
2) Configure LSB
# Configure port Ethernet 1/0/4 of LSB to allow only IP packets with the source MAC
address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.
<Sysname> system-view
[Sysname] user-bind mac-addr 0001-0203-0406 ip-addr 192.168.0.1 interface
ethernet 1/0/4
# Configure port Ethernet1/0/5 of LSB to allow only IP packets with the source MAC
address of 00-01-02-03-04-07 and the source IP address of 192.168.0.2 to pass.
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Chapter 1 MAC-IP-Port Binding Configuration
1-4
[Sysname] user-bind mac-addr 0001-0203-0407 ip-addr 192.168.0.2 interface
ethernet 1/0/5
Altri manuali per S5510 Series
5
Questo manuale è adatto per i seguenti modelli
1
Indice
Altri manuali H3C Interruttore
H3C
H3C SOHO IE4300 Manuale di installazione
H3C
H3C H3C S3600 Series Istruzioni per l'installazione
H3C
H3C S7500 Series Manuale utente
H3C
H3C S7500 Series Manuale utente
H3C
H3C WX3000 Series Manuale di istruzioni
H3C
H3C S12500 Series Manuale utente
H3C
H3C S7500X Series Manuale utente
H3C
H3C S12500 Series Manuale utente
H3C
H3C S9500 Series Istruzioni per l'installazione
H3C
H3C S3100V2-52TP Manuale utente
H3C
H3C S12500 Series Manuale utente
H3C
H3C S5560S Series Manuale di istruzioni
H3C
H3C S6850 Series Manuale utente
H3C
H3C S1850-X Series Manuale utente
H3C
H3C S10500X-G Series Manuale del proprietario
H3C
H3C S6825 Series Manuale utente
H3C
H3C S3100 Series Manuale utente
H3C
H3C s5820x series Manuale utente
H3C
H3C s5800 series Manuale utente
H3C
H3C S5560S-SI Manuale utente
