Benutzeranleitung / Produktwartung Layer 3 Switches des Produzenten Allied Telesis
Zur Seite of 31
C613-16103-00 REV A www .alliedtelesis.com How T o | Intr oduction Allied T elesis switches include a range of sophisti cated security features at la y er 2 and la yer 3. This How T o Note des cribes these featur es and includes brief examples of ho w to configure them.
Which pr oducts and software v ersions does this information apply to? Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 2 Appendix: Configuration scripts for MA C-for ced forwarding example ... ................................ 27 Edge switch 1 .
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 3 Securing the de vice Securing the de vice The first step towar ds making a secur e network is to secur e the netw orking equipment itself. There ar e two aspects to this. Firstly , ph ysical security is vital—lock your netw orking equ ipment a wa y .
Pr otecting the network Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 4 Ser vice pro viders need to pre vent storms fr om disrupting ser vices to customers.
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 5 Pr otecting the network Using QoS policy-based storm pr otection P olicy-based storm protection lets y ou specify one of a range of actions for the s witch to take when it detects a br oadcast storm.
Pr otecting the network Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 6 Example The following example applie s storm protection to classified br oadcast traffic on por t 1 . If there is a storm, it tak es the link down f or 60 seconds.
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 7 Pr otecting the network 2. Set the sensitivity in detecting rapid MA C mo vement, by using the f ollowing command to tell the switch how many times a MA C addr ess can move ports in one second: set switch thrashlimit=5.
Pr otecting the network Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 8 IGMP filtering IGMP filtering lets you dictate exac tly which multicast gr oups a spec ific port can receiv e , by cr eating a fil ter list and applying it to the port.
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 9 Managing the de vice securel y Mana ging the de vice securel y In Ethernet and br oadc ast netw orks the pri vacy of traffic is not g uaranteed. Hubs and networks outside the administrator's contr ol ma y leak sensitive data to unwanted r ecipients.
Managing the de vice securel y Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 10 Using SSL for secur e w eb access If you pr efer to configur e the switch using the conv enient we b-based GUI, then this is un encr ypted by default.
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 11 Managing the de vice securel y Examples T o allow the user “ste ve” full r ead, write and notify SNMP access to the switch: enable snmp add snmp view=full oid=1.
Managing the de vice securel y Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 12 Whitelisting telnet hosts For an y remote management of a netw ork de vice, Allied T elesis recommends y ou use SSH, Secure HTTP ( SSL), or SNMPv3.
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 13 Managing the de vice securel y Building a whitelist thr ough QoS On A T -8948, A T -9900, A T -990 0s, and x900 Series switches, use classifiers to build a whitelist and QoS to apply it.
Identifying the user Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 14 Identifying the user This section describes methods for authorising and tracking users and pre venting them fr om changing their identi ty on the netw ork.
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 15 Identifying the user Rejecting Gratuitous ARP (GARP) Hosts can use GARP to anno unce th eir presence on a subnet. It is a helpfu l mechanism, par ticularly when ther e is a chance of duplicate addresses.
Identifying the user Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 16 For mor e information about setting up DHCP snooping, see How T o Use DHCP Snooping, Option 82 and Filtering on Rapier , A T -8800 and A T -8600 Ser ies Switc hes or How T o Use DHCP Snooping, Option 82 and Filtering on x900 Ser ies Switches .
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 17 Identifying the user Using DHCP snooping to track clients If yo u r D H C P s e r ve r s u p po r ts i t , yo u c an u s e “option 82” to record mor e information about DHCP clients.
Pro tecting the user Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 18 Pr otecting the user This section describes the following methods of pr otecting users fr om other users on the network: z “Using private VLANs” on page 18 .
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 19 Pro tecting the user Example T o create a private VLAN with por ts 2-6 in it, with an uplink trunk group of por ts 24 and 2 .
Pro tecting the user Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 20 The following figur e shows a network that can use either local pr oxy ARP or MA C-for ced forwar ding—the examples in both the fo llowing sections r efer to this netw ork.
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 21 Pro tecting the user Configuration of edge swi tc hes 1. Create the VLANs, specifying that the y are pr ivate. Mak e a different VLAN for each type of traffic that y o u want to contr ol differentl y .
Pro tecting the user Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 22 Use the following configuration f or edge s witches 2 and 3 (A T -8648 s witches in this example): ena .
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 23 Pro tecting the user # Create a classifier to match all traffic in VLANs 101-104 create class=10 ipsa=192.168.0.0/16 ipda=192.168.0.0/16 # Create a classifier to match voice traffic create class=100 ipsa=192.
Pro tecting the user Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 24 Configuration of edge swi tc hes 1. Create a VLAN f or each type of ser vice (for example , voice, video, and data). With so ftw are vers io ns 2 91 -04 and ea rli er , th e V LAN s mu st b e pr iv ate VLA Ns .
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 25 Pro tecting the user z Ho w T o Configure Micr osoft® Windows XP Vir tual Private Network (V PN) c lient inter operability .
Pro tecting the user Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 26 T o block the W32.Slammer worm on port 1 , which does not ha ve an SQL client or s er ver attached to i.
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 27 Appendix: Configuration scripts for MA C-forced f orwarding example Appendix: Configuration scripts for MA C-for ced forwar .
Appendix: Configuration scripts for MA C-forced f orwarding example Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 28 Edge s witch 2 Edge switch 2 is connected to port 50 of edge switch 1 .
Create A Secure Netw ork With Allied T elesis Managed La yer 3 Sw itches 29 Appendix: Configuration scripts for MA C-forced f orwarding example Edge s witch 3 Edge switch 3 is connected to port 49 of edge switch 1 .
Appendix: Configuration scripts for MA C-forced f orwarding example Creat e A Secure Netw ork With Allied T elesis Managed La yer 3 Switches 30 Access Router set system name="Access Ro uter".
USA Headq u ar ters | 19800 Nor th Cr eek Parkwa y | S u ite 200 | Bothell | WA 98011 | USA | T: +1 800 424 4284 | F: +1 425 481 3895 E u r opea n Headq u ar ters | Via Motta 24 | 6830 Chiasso | Switzerla n d | T: +41 91 69769.
Ein wichtiger Punkt beim Kauf des Geräts Allied Telesis Layer 3 Switches (oder sogar vor seinem Kauf) ist das durchlesen seiner Bedienungsanleitung. Dies sollten wir wegen ein paar einfacher Gründe machen:
Wenn Sie Allied Telesis Layer 3 Switches noch nicht gekauft haben, ist jetzt ein guter Moment, um sich mit den grundliegenden Daten des Produkts bekannt zu machen. Schauen Sie zuerst die ersten Seiten der Anleitung durch, die Sie oben finden. Dort finden Sie die wichtigsten technischen Daten für Allied Telesis Layer 3 Switches - auf diese Weise prüfen Sie, ob das Gerät Ihren Wünschen entspricht. Wenn Sie tiefer in die Benutzeranleitung von Allied Telesis Layer 3 Switches reinschauen, lernen Sie alle zugänglichen Produktfunktionen kennen, sowie erhalten Informationen über die Nutzung. Die Informationen, die Sie über Allied Telesis Layer 3 Switches erhalten, werden Ihnen bestimmt bei der Kaufentscheidung helfen.
Wenn Sie aber schon Allied Telesis Layer 3 Switches besitzen, und noch keine Gelegenheit dazu hatten, die Bedienungsanleitung zu lesen, sollten Sie es aufgrund der oben beschriebenen Gründe machen. Sie erfahren dann, ob Sie die zugänglichen Funktionen richtig genutzt haben, aber auch, ob Sie keine Fehler begangen haben, die den Nutzungszeitraum von Allied Telesis Layer 3 Switches verkürzen könnten.
Jedoch ist die eine der wichtigsten Rollen, die eine Bedienungsanleitung für den Nutzer spielt, die Hilfe bei der Lösung von Problemen mit Allied Telesis Layer 3 Switches. Sie finden dort fast immer Troubleshooting, also die am häufigsten auftauchenden Störungen und Mängel bei Allied Telesis Layer 3 Switches gemeinsam mit Hinweisen bezüglich der Arten ihrer Lösung. Sogar wenn es Ihnen nicht gelingen sollte das Problem alleine zu bewältigen, die Anleitung zeigt Ihnen die weitere Vorgehensweise – den Kontakt zur Kundenberatung oder dem naheliegenden Service.
