Enterasys Networks 6H2xx - Manual (Page 408)

Example 6, Locking a MAC Address to a Port Using Classification Rules
13-36 VLAN Operation and Network Applications
In this example, the AppleTalk traffic is routed only to AppleTalk users (ports 1, 2, 5, and 6), while
IP traffic is allowed to be seen by IP users (ports 3, 4, and 7) and by IP/AppleTalk users (ports 1, 2,
5, and 6).
13.17 EXAMPLE 6, LOCKING A MAC ADDRESS TO A PORT USING
CLASSIFICATION RULES
The following example illustrates how to add security by “locking” an individual MAC address to
a port on the switch module (S1). This would typically be done to ensure that only a particular
device can gain access to the network from a specific port. Traffic received by the switch from any
MAC address other than the one assigned to the “locked” port will be discarded.
In this example, illustrated in Figure 13-19 , switch S1 will be configured to lock ports 1 and 2 to
the source address 00.00.00.00.00.0A and 00.00.00.00.00.0B of Workstation 1 and 2, respectively.
Figure 13-19 Locking Ports According to Classification Rule
13.17.1 Solving the Problem
In this example, switches S1 and S2 need to be configured with two 802.1Q VLANs. Since the
switch, by default, already has one VLAN created (the Default VLAN), only one new VLAN will
need to be created. In this example, the new VLAN will be named the Red VLAN.
The object of this is to configure S1 so that when it receives a frame on Port 1 from MAC address
00.00.00.00.00.0A, the frame is classified into the Red VLAN. When S1 receives a frame on Port
1 from a MAC address other than 00.00.00.00.00.0A, the frame is associated with the Default
VLAN. To accomplish this, S1 is configured so that the frames originating from the Red VLAN
are eligible to be forwarded out the desired ports. The frames associated with the Default VLAN
are not forwarded to any ports and are discarded by S1.
4046_25
S1
Port 1
Port 2
Locked
Ports
Uplink to Network
00.00.00.00.00.0B
Workstation 2
00.00.00.00.00.0A
Workstation 1