H3C S5510 Series Manual de usuario
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Table of Contents
i
Table of Contents
Chapter 1 MAC-IP-Port Binding Configuration ..........................................................................1-1
1.1 MAC-IP-Port Binding Overview .........................................................................................1-1
1.2 Configuring MAC-IP-Port Binding......................................................................................1-1
1.3 Displaying and Maintaining MAC-IP-Port Binding.............................................................1-2
1.4 MAC-IP-Port Binding Configuration Example....................................................................1-2
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Chapter 1 MAC-IP-Port Binding Configuration
1-1
Chapter 1 MAC-IP-Port Binding Configuration
1.1 MAC-IP-Port Binding Overview
MAC-IP-port binding allows a device to filter packets and thus enhance security. With
MAC-IP-port binding configured, a port checks whether the source MAC and IP
addresses of an inbound packet is identical to the configured MAC-to-IP binding on the
port. If so, it forwards the packet; otherwise, it discards the packet.
1.2 Configuring MAC-IP-Port Binding
Follow these steps to configure MAC-IP-port binding:
To do… Use the command… Remarks
Enter system view system-view —
Bind a MAC-IP
address pair to
multiple ports
user-bind mac-addr mac-address
ip-addr ip-address interface
interface-list
interface interface-type
interface-number
Configu
re
MAC-IP
-port
binding
Bind a MAC-IP
address pair to
the current
port user-bind mac-addr mac-address
ip-addr ip-address
Required
Use either
approach.
Caution:
zThe port in an aggregation group does not support MAC-IP-Port binding
configuration.
zS3610&S5510 Series Ethernet Switches differentiate binding through “MAC
address + IP address + port”. You can bind a MAC address with only one IP address
and vice versa. However, you can bind a MAC-IP pair to multiple ports.
zMAC-IP-port binding is on a per-port basis, that is, a port with MAC-IP-port binding
enabled filters packets independently; it does not affect any other port.
zThe MAC address to be bound cannot be all 0s, all Fs, or a multicast address. The
IP address can only be a Class A, Class B, or Class C address and can neither be
127.x.x.x nor 0.0.0.0.
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Chapter 1 MAC-IP-Port Binding Configuration
1-2
1.3 Displaying and Maintaining MAC-IP-Port Binding
To do… Use the command… Remarks
Display the MAC-IP-port binding
entries configured on all ports display user-bind
Display the MAC-IP-port binding
entries configured on all ports for a
specified MAC address
display user-bind
mac-addr mac-address
Display the MAC-IP-port binding
entries configured on all ports for a
specified IP address
display user-bind
ip-addr ip-address
Display the MAC-IP-port binding
entries configured on specified ports display user-bind
interface interface-list
Available in
any view
1.4 MAC-IP-Port Binding Configuration Example
I. Network Requirements
As shown in Figure 1-1, switches LSAand LSB and data terminals DT1, DT2, and DT3
are on an Ethernet. DT1 and DT2 are connected to ports Ethernet 1/0/4 and Ethernet
1/0/5 of LSB respectively, DT3 is connected to port Ethernet 1/0/4 of LSA, while LSB is
connected to port Ethernet 1/0/5 of LSA.
Detailed requirements are as follows:
zOn port Ethernet 1/0/4 of LSA, only IP packets with the source MAC address of
00-01-02-03-04-05 and the source IP address of 192.168.0.3 can pass.
zOn port Ethernet 1/0/5 of LSA, only IP packets with the source MAC address of
00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.
zOn port Ethernet 1/0/4 of LSB, only IP packets with the source MAC address of
00-01-02-03-04-06 and the source IP address of 192.168.0.1 can pass.
zOn port Ethernet 1/0/5 of LSB, only IP packets with the source MAC address of
00-01-02-03-04-07 and the source IP address of 192.168.0.2 can pass.
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Chapter 1 MAC-IP-Port Binding Configuration
1-3
II. Network Diagram
PC
PC
PC
LSA
LSB DT3
MAC0
IP192
to inte
DT2
MAC00-01-02-03-04-
IP192.168.0.2
to interface Ethernet
DT1
MAC00-01-02-03-04-06
IP 192.168.0.1
to interface Ethernet1/0/4
Ethernet1/0/4 Ethernet1/0/5
Ethernet1/0/5 Ethernet1/0/4
0-01-02-03-04-05
.168.0.3
rface Ethernet1/0/4
07
1/0/5
PC
PC
PC
LSA
LSB DT3
MAC0
IP192
to inte
DT2
MAC00-01-02-03-04-
IP192.168.0.2
to interface Ethernet
DT1
MAC00-01-02-03-04-06
IP 192.168.0.1
to interface Ethernet1/0/4
Ethernet1/0/4 Ethernet1/0/5
Ethernet1/0/5 Ethernet1/0/4
0-01-02-03-04-05
.168.0.3
rface Ethernet1/0/4
07
1/0/5
PC
PC
PC
LSA
LSB DT3
MAC0
IP192
to inte
DT2
MAC00-01-02-03-04-
IP192.168.0.2
to interface Ethernet
DT1
MAC00-01-02-03-04-06
IP 192.168.0.1
to interface Ethernet1/0/4
Ethernet1/0/4 Ethernet1/0/5
Ethernet1/0/5 Ethernet1/0/4
0-01-02-03-04-05
.168.0.3
rface Ethernet1/0/4
07
1/0/5
g
Figure 1-1 Network diagram for MAC-IP-port bindin
III. Configuration Procedure
1) Configure LSA
# Configure port Ethernet 1/0/4 of LSA to allow only IP packets with the source MAC
address of 00-01-02-03-04-05 and the source IP address of 192.168.0.3 to pass.
<Sysname> system-view
[Sysname] interface ethernet 1/0/4
[Sysname-Ethernet1/0/4] user-bind mac-addr 0001-0203-0405 ip-addr
192.168.0.3
[Sysname-Ethernet1/0/4] quit
# Configure port Ethernet 1/0/5 of LSA to allow only IP packets with the source MAC
address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.
[Sysname] interface ethernet 1/0/5
[Sysname-Ethernet1/0/5] user-bind mac-addr 0001-0203-0406 ip-addr
192.168.0.1
2) Configure LSB
# Configure port Ethernet 1/0/4 of LSB to allow only IP packets with the source MAC
address of 00-01-02-03-04-06 and the source IP address of 192.168.0.1 to pass.
<Sysname> system-view
[Sysname] user-bind mac-addr 0001-0203-0406 ip-addr 192.168.0.1 interface
ethernet 1/0/4
# Configure port Ethernet1/0/5 of LSB to allow only IP packets with the source MAC
address of 00-01-02-03-04-07 and the source IP address of 192.168.0.2 to pass.
Operation Manual – MAC-IP-Port Binding
H3C S3610&S5510 Series Ethernet Switches Chapter 1 MAC-IP-Port Binding Configuration
1-4
[Sysname] user-bind mac-addr 0001-0203-0407 ip-addr 192.168.0.2 interface
ethernet 1/0/5
Otros manuales para S5510 Series
5
Este manual sirve para los siguientes modelos
1
Tabla de contenidos
Otros manuales de Cambiar de H3C
H3C
H3C S12500 Series Guía rápida
H3C
H3C S9500 Series Manual de usuario
H3C
H3C S5120-EI Series Manual de usuario
H3C
H3C S12502X-AF Manual de usuario
H3C
H3C S3100-26T P-EI-W Manual de usuario
H3C
H3C PSR150-A Manual de instalación
H3C
H3C S9500 Series Manual de usuario
H3C
H3C S5130S-EI series Manual de usuario
H3C
H3C S7500 Series Manual de usuario
H3C
H3C S10500 Series Manual de usuario
H3C
H3C S9500 Series Manual de usuario
H3C
H3C S9500 Series Manual de usuario
H3C
H3C S3100 Series Guía de instalación
H3C
H3C S6850 Series Manual de usuario
H3C
H3C S6850-56HF Manual de operación y mantenimiento
H3C
H3C H3C S7500E Series Manual de instalación
H3C
H3C S3100 Series Instrucciones de instalación
H3C
H3C S5120-EI Series Manual de usuario
H3C
H3C S3600V2 SERIES Manual de operación y mantenimiento
H3C
H3C S5500-EI series Manual de usuario
