D-Link xStack DES-6500 User Manual - Cpu Interface Filtering
xStack DES-6500 Modular Layer 3 Chassis Ethernet Switch User Manual
CPU Interface Filtering
Due to a chipset limitation and needed extra switch security, the xStack DES-6500 chassis switch incorporates CPU
Interface filtering. This added feature increases the running security of the Switch by enabling the user to create a list of
access rules for packets destined for the Switch’s CPU interface. Employed similarly to the Access Profile feature
previously mentioned, CPU interface filtering examines Ethernet, IP and Packet Content Mask packet headers destined for
the CPU and will either forward them or filter them, based on the user’s implementation. As an added feature for the CPU
Filtering, the xStack DES-6500 chassis switch allows the CPU filtering mechanism to be enabled or disabled globally,
permitting the user to create various lists of rules without immediately enabling them.
Creating an access profile for the CPU is divided into two basic parts. The first is to specify which part or parts of a frame
the Switch will examine, such as the MAC source address or the IP destination address. The second part is entering the
criteria the Switch will use to determine what to do with the frame. The entire process is described below.
Due to a backward compatability issue, when a user upgrades to R3 firmware (3.00-B29),
all settings previously configured for any ACL function (CPU ACL included) on the Switch
will be lost. We recommend that the user save a configuration file of current settings before
upgrading to R3 firmware.
CPU Interface Filtering State Settings
In the following window, the user may globally enable or disable the CPU Interface Filtering mechanism by using the pull-
down menu to change the running state. To access this window, click
Configuration > CPU Interface Filtering > CPU
Interface Filtering State
. Choose
Enabled
to enable CPU packets to be scrutinized by the Switch and
Disabled
to
disallow this scrutiny.
Figure 6- 71. CPU Interface Filtering State Settings window
CPU Interface Filtering Table
The
CPU Interface Filtering Table
displays the CPU Access Profile Table entries created on the Switch. To view the
configurations for an entry, click the hyperlinked
Profile ID
number.
Figure 6- 72. CPU Interface Filtering Table
To add an entry to the
CPU Interface Filtering Table
, click the
Add
button. This will open the
CPU Interface Filtering
Configuration
page, as shown below. There are three
Access Profile Configuration
pages; one for
Ethernet
(or MAC
address-based) profile configuration, one for
IP
address-based profile configuration and one for the
Packet Content
102