D-Link DFL-500 - Manual (Page 40)

DFL-500 User Manual
40
Adding an IP Pool
IP/MAC binding
IP/MAC binding protects the DFL-500 NPG and your network from IP spoofing attacks. IP spoofing attempts
to use the IP address of a trusted computer to connect to or through the firewall from a different computer.
The IP address of a computer can easily be changed to a trusted address, but MAC addresses are added to
ethernet cards at the factory and cannot easily be changed.
You can enter the static IP addresses and corresponding MAC addresses of trusted computers in the Static
IP/MAC table.
If you have trusted computers with dynamic IP addresses that are set by the DFL-500 DHCP server, the
firewall adds these IP addresses and their corresponding MAC addresses to the Dynamic IP/MAC table. See
Providing DHCP services to your internal network . The dynamic IP/MAC binding table is not available in
Transparent mode.
IP/MAC binding can be enabled for packets connecting to the firewall or passing through the firewall.
If you enable IP/MAC binding and change the IP address of a computer with an IP address or MAC address
in the IP/MAC list, you must also change the entry in the IP/MAC list or the computer will not have access to
or through the firewall. You must also add the IP/MAC address pair of any new computer that you add to your
network or this computer will not have access to or through the firewall.
This section describes:
•
Configuring IP/MAC binding for packets going through the firewall
•
Configuring IP/MAC binding for packets going to the firewall
•
Adding IP/MAC addresses
•
Viewing the dynamic IP/MAC list
•
Enabling IP/MAC binding
Configuring IP/MAC binding for packets going through the firewall
Use the following procedure to use IP/MAC binding to filter packets that would normally be matched with
firewall policies to be able to go through the firewall.
• Go to Firewall > IP/MAC Binding > Setting .
• Select Enable IP/MAC binding going through the firewall.
• Go to Firewall > IP/MAC Binding > Static IP/MAC .
• Select New to add IP/MAC binding pairs to the IP/MAC binding list.