D-Link DES-3052P - Page 356

DES-3028 DES-3028P DES-3028G DES-3052 DES-3052P Layer 2 Fast Ethernet Switch CLI Reference Manual
Command Desc
ription
Step 1
create access_profile ethernet source_mac FF-FF-FF-FF-
FF-FF ethernet_type profile_id 1
– Create access profile 1
To match Ethernet Type and Source MAC address.
Step 2
config access_profile profile_id 1 add access_id 1 ethernet
source_mac 01-02-03-04-05-06
ethernet_type 0x806
port 1-28 permit
– Configure access profile 1
– Only if the gateway’s ARP packet that contains the
correct Source MAC in Ethernet frame can pass
through the switch.
Step 3
create access_profile packet_content_mask
offset_0-15 0x0 0x0 0x0 0xFFFF0000
Ethernet Type(2-byte)
offset_16-31 0x0 0x0 0x0 0xFFFFFFFF
Sdr IP(4-byte)
profile_id 2
– Create access profile 2 for no 802.1Q header
– The offset_0-15: mask for Ethernet Type, the
significant byte are from 12 to 13.
– The offset_16-31: mask for Sender IP in ARP
packet, the significant byte are from 28 to 31.
Step 4
config access_profile profile_id 2 add access_id 1
packet_content
offset 12 0x08060000
Ethernet Type(2-byte): ARP
offset 28 0x0A5A5A5A
Sdr IP(4-byte): 10.90.90.90
port 1-28 deny
– Configure access profile 2
– The rest ARP packets whose Sender IP claim they
are the gateway’s IP will be dropped.
Step 5
create access_profile packet_content_mask
offset_0-15 0x0 0x0 0x0 0xFFFF0000
Vlan Tag(2-byte)
offset_16-31 0xFFFF0000 0x0 0x0 0x0
Ethernet Type(2-byte)
offset_32-47 0xFFFFFFFF 0x0 0x0 0x0
Sdr IP(4-byte)
profile_id 3
– Create access profile 3 for 802.1Q header
– The offset_0-15: mask for Vlan Tag, the significant
byte are from 12 to 13.
– The offset_16-31: mask for Ethernet Type, the
significant byte are from 16 to 17.
– The offset_32-47: mask for Sender IP in ARP
packet, the significant byte are from 32 to 35.
Step 6
config access_profile profile_id 3 add access_id 1
packet_content
offset 12 0x81000000
Vlan Tag(2-byte)
offset 16 0x08060000
Ethernet Type(2-byte): ARP
offset 32 0x0A5A5A5A
Sdr IP(4-byte): 10.90.90.90
port 1-28 deny
– Configure access profile 3
– The rest ARP packets whose Sender IP claim they
are the gateway’s IP will be dropped.
Step 7
Save
– Save config
351