D-Link DSA-3200 Technical Information PDF herunterladen (Seite 146)

xStack

DGS-3200 Series Layer 2 Managed Gigabit Ethernet Switch Web UI Reference Guide

132

Common IP Management Security Issues

Currently, certain limitations and issues in IP management structures can lead to serious security problems. Auditing mechanisms,

such as syslog, application log, firewall log, etc, are mainly based on client IP information. However, such log information is

meaningless if the client IP address can be easily changed. IP conflict, the most common problem in today’s networks, is another

major security concern. Without IMPB, any user can change an IP address manually and cause conflict with other resources, such

as other PCs, core switches, routers or servers. Not only does this duplicate IP create an auditing issue, it also poses potential risk

to the entire network.

Figure 5 - 8. Illustration of Common IP Security Problems

ARP spoofing attacks in which malicious users intercept traffic or interrupt connections by manipulating ARP packets are another

serious challenge in securing today’s network. Further information on how ARP spoofing attacks work can be found in the

Appendix, "Mitigating ARP Spoofing Attack via Packet Content ACL," located in the back of this manual.

Solutions to Improve IP Management Security

DGS-3200 Series switches have introduced IMPB technology to protect networks from attacks. By using IP-MAC-Port Binding,

all packets are dropped by a switch when the MAC address, IP address, and connected port are not in the IMPB white list. IMPB

allows the user to choose either ARP or ACL mode. In addition, an IMPB white list can be dynamically created with the DHCP

snooping option. DHCP snooping is a global setting and can be enabled on top of ACL or ARP mode. Each option has its

advantages and disadvantages.

ARP Mode

In ARP Mode, a switch performs ARP Packet Inspection in which it checks the IP-MAC pairs in ARP packets and denies

unauthorized ones. An advantage of ARP mode is that it does not consume any ACL rules on the switch. Nonetheless, since the

switch only checks ARP packets, it cannot block unauthorized clients who do not send out ARP packets.

ACL Mode

In ACL Mode, a switch performs IP Packet Inspection in addition to ARP Packet Inspection. Essentially, ACL rules will be used

to permit statically configured IMPB entries and deny other IP packets with the incorrect IP-MAC pairs. The distinct advantage of

ACL Mode is that it ensures better security by checking both ARP Packets and IP Packets. However, doing so requires the use of

ACL rules. ACL Mode can be viewed as an enhanced version of ARP Mode because ARP Mode is enabled by default when ACL

Mode is selected.

Strict and Loose State

Other than ACL and ARP mode, users can also configure the state on a port for granular control. There are two states, Strict and

Loose, and only one state can be selected per port. If a port is set to Strict state, all packets sent to the port are denied (dropped) by

default. The switch will continuously compare all IP and ARP packets it receives on that port with its IMPB entries. If the IP-

MAC pair in the packet matches the IMPB entry, the MAC address will be unblocked and subsequent packets sent from this client

will be forwarded. On the other hand, if a port is set to Loose state, all packets sent to the port are permitted (forwarded) by

default. The switch will continuously compare all ARP packets it receives on that port with its IMPB entries. If the IP-MAC pair

in the ARP packet does not match the IMPB white list, the MAC address will be blocked and subsequent packets sent from this

client will be dropped.

192.168.1.1

00E0-0211-1111

192.168.1.2

00E0-0211-2222

192.168.1.3

00E0-0211-3333

IP Conflict

Auditing

Problem

1 2 ... 141 142 143 144 145 146 147 148 149 150 151 ... 320 321

D-Link DSA-3200 Technical Information Seite 146

Kommentare zu diesen Handbüchern

D-Link DSA-3200 Technical Information Seite 146

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Vernetzung D-Link DSA-3200