D-Link DGS-3426P Product Manual - Page 294

xStack® DGS-3400 Series Layer 2 Gigabit Ethernet Managed Switch packets. An example of this is that a malicious user can perform DoS attacks by statically configuring the ARP table on their PC. In this case, the Switch cannot block such attacks because the PC will not send out ARP packets. Allow Zero IP Use the pull-down menu to enable or disable this feature. Once enabled, the Switch will allow ARP packets with a Source IP of 0.0.0.0 to pass through. This is useful in some scenarios when a client (for example, a wireless Access Point,) sends out an ARP request packet before accepting the IP address from a DHCP server. In this case, the ARP request packet sent out from the client will contain a Source IP of 0.0.0.0. The Switch will need to allow such packets to pass, or else the client cannot know if there is another duplicate IP address in the network. Forward DHCP PKT By default, the Switch will forward all DHCP packets. However, if the port state is set to Strict, all DHCP packets will be dropped. In that case, select Enable so that the port will forward DHCP packets even under Strict state. Enabling this feature also ensures that DHCP snooping works properly. Mode Use the pull-down menu to select ARP or ACL mode. ARP Mode - When selecting this mode, the Switch will perform ARP Packet Inspection only and no ACL rules will be used. ACL Mode - When selecting this mode, the Switch will perform IP Packet Inspection in addition to ARP Packet Inspection. ACL rules will be used under this mode. Stop Learning Threshold (0-500) Whenever a MAC address is blocked by the Switch, it will be recorded in the Switch's L2 Forwarding Database (FDB) and associated with a particular port. To prevent the Switch FDB from overloading in case of an ARP DoS attack, the administrator can configure the threshold when a port should stop learning illegal MAC addresses. Enter a Stop Learning threshold between 0 and 500. Entering 500 means the port will enter the Stop Learning state after 500 illegal MAC entries and will not allow additional MAC entries, both legal or illegal, to be learned on this port. In the Stop Learning state, the port will also automatically purge all blocked MAC entries on this port. Traffic from legal MAC entries are still forwarded. Entering 0 means no limit has been set and the port will keep learning illegal MAC addresses. Recover Learning This feature can only be applied when a port is already in Stop Learning state. Check Normal to recover the port back to normal state, under which the port will start learning both illegal and legal MAC addresses again. Selecting this feature when the port is in Normal state will do nothing. Max Entry (1-50) Specifies the maximum number of dynamic (DHCP snooped) IP-MAC-Port Binding entries that can be learned on the port. Enter a value between 1 to 50 to restrict dynamic IMPB entries on this port. By default, the-per port max entry has No Limit. Click Apply to implement the changes. IMPB Entry Settings The table on this window, which is also known as the "IMPB white list," is used to create Static IP-MAC-Port Binding entries on the Switch. To view this window, click Security > IP-MAC-Port Binding > IMPB Entry Settings, as shown below. 285