Netgear FS728TLP Web Management User Guide - Page 314

ProSAFE FS526Tv2, FS726Tv2, and FS728TLP Smart Switches 6. Select Security > ACL > Advanced > IP Binding Configuration. The IP Binding Configuration screen displays. 7. Assign IP ACL ID 1 to interfaces 2, 3, and 4, and assign a sequence number of 1. By default, this IP ACL is bound on the inbound direction, so it examines traffic as it enters the smart switch. For more information about configuring IP ACL bindings, see Configure IP ACL Bindings for Ports and LAGs on page 216. The IP ACL with ID 1 functions in the following way: The IP ACL matches all packets with the source IP address and subnet mask of the finance department's network and denies these packets on ports 2, 3, and 4. The second rule permits all nonfinance traffic on the ports. The second rule is required because the configuration includes a default deny all IP traffic rule as the lowest-priority rule of the IP ACL table. 802.1X Authentication LANs are often deployed in environments that permit unauthorized devices to be physically attached to the LAN infrastructure, or permit unauthorized users to attempt to access the LAN through equipment already attached. In such environments, it can be desirable to restrict access to the services offered by the LAN to those users and devices that are permitted to use those services. Port-based network access control uses the physical characteristics of LAN infrastructures to allow for authentication and authorization of devices that are attached to a LAN port. In this context, a port is a single point of attachment to the LAN, such as ports of MAC bridges and associations between stations or access points in wireless LANs. The IEEE 802.1X standard describes an architectural framework within which authentication and consequent actions occur. It also establishes the requirements for a protocol between the authenticator (the system that passes an authentication request to the authentication server) and the supplicant (the system that requests authentication), and between the authenticator and the authentication server. The smart switch supports a guest VLAN, which allows unauthenticated users to have limited access to the network resources. Note: You can use QoS features to provide rate limiting on the guest VLAN to limit the network resources on the guest VLAN. Another 802.1X feature is the ability to configure a port for Extensible Authentication Protocol over LAN (EAPoL) packet forwarding. You can disable or enable the forwarding of EAPoL when 802.1X is disabled on the smart switch. Configuration Examples 314