Riverstone Networks WICT1-12 - Manual (Page 556)

25-10 Riverstone Networks RS Switch Router User Guide Release 8.0
Layer-2 Security Filters Security Configuration
Example 1: Address Filters
Source filter: The consultant is not allowed to access any file servers. The consultant is only allowed to interact with
the engineers on the same Ethernet segment – port et.1.1. All traffic coming from the consultant’s MAC address will
be dropped.
Destination filter: No one from the engineering group (port et.1.1) should be allowed to access the finance server. All
traffic destined to the finance server's MAC will be dropped.
Flow filter: Only the consultant is restricted access to one of the finance file servers. Note that port et.1.1 should be
operating in flow-bridging mode for this filter to work.
Static Entries Example
Source static entry: The consultant is only allowed to access the engineering file servers on port et.1.2.
Destination static entry: Restrict "login multicasts" originating from the engineering segment (port et.1.1) from
reaching the finance servers.
filters add address-filter name consultant source-mac 001122:334455 vlan 1
in-port-list et.1.1
filters add address-filter name finance dest-mac AABBCC:DDEEFF vlan 1 in-port-list
et.1.1
filters add address-filter name consult-to-finance source-mac 001122:334455 dest-mac
AABBCC:DDEEFF vlan 1 in-port-list et.1.1
filters add static-entry name consultant source-mac 001122:334455 vlan 1 in-port-list
et.1.1 out-port-list et.1.2 restriction allow
filters add static-entry name login-mcasts dest-mac 010000:334455 vlan 1 in-port-list
et.1.1 out-port-list et.1.3 restriction disallow