HP 8000M User Manual
Page 102
6-26
Configuring the Switch
Enhancing Security By Configuring Authorized IP Managers
C
o
n
fig
u
rin
g
th
e
Sw
itc
h
Table 6-3.
Analysis of IP Mask for Multiple-Station Entries
Figure 6-16. Example of How the Bitmap in the IP Mask Defines Authorized
Manager Addresses
1st
Octet
2nd
Octet
3rd
Octet
4th
Octet
Manager-Level or Operator-Level Device Access
IP Mask
255
255
255
0
The “255” in the first three octets of the mask specify that only the exact
value in the octet of the corresponding IP address is allowed. However,
the zero (0) in the 4th octet of the mask allows any value between 0 and
255 in that octet of the corresponding IP address. This mask allows switch
access to any device having an IP address of 11.33.248.
xxx, where xxx is
any value from 0 to 255.
Authorized
Manager IP
11
33
248
5
IP Mask
255
255
255
249
In this example (figure 6-16, below), the IP mask allows a group of up to
4 management stations to access the switch. This is useful if the only
devices in the IP address group allowed by the mask are management
stations. The “249” in the 4th octet means that bits 0 and 3 - 7 of the 4th
octet are fixed. Conversely, bits 1 and 2 of the 4th octet are variable. Any
value that matches the authorized IP address settings for the fixed bits is
allowed for the purposes of IP management station access to the switch.
Thus, any management station having an IP address of 11.33.248.1, 3, 5,
or 7 can access the switch.
Authorized
IP Address
11
33
248
5
4th Octet of IP Mask:
4th Octet of Authorized IP Address:
249
5
Bit Numbers
Bit
7
Bit
6
Bit
5
Bit
4
Bit
3
Bit
2
Bit
1
Bit
0
Bit Values
128
64
32
16
8
4
2
1
4th Octet of
IP Mask (249)
Bits 1 and 2 in the mask are “off”, and bits 0 and 3
- 7 are “on”, creating a value of 249 in the 4th octet
of the mask.
Where a mask bit is “on”, the corresponding bit
setting in the address of a potentially authorized
station must match the IP Authorized Address
setting for that same bit. Where a mask bit is “off”
the corresponding bit setting in the address can be
either “on” or “off”. In this example, in order for a
station to be authorized to access the switch:
• The first three octets of the station’s IP address
must match the Authorized IP Address.
• Bit 0 of the 4th octet in the station’s address
must be “on” (value = 1).
• Bits 3 through 7 of the 4th octet in the station’s
address must be “off” (value = 0).
• Bits 1 and 2 can be either “on” or “off”.
This means that stations with the IP address
11.33.248.
X (where X is 1, 3, 5, or 7) are authorized.
4th Octet of
IP Authorized
Address (5)