Netgear XCM8806 Chassis User Manual - Page 435

NETGEAR 8800 User Manual XCM8800 has enhanced security features designed to protect, rapidly detect, and correct anomalies in your network. NETGEAR products incorporate a number of features designed to enhance the security of your network while resolving issues with minimal network disruption. No one feature can ensure security, but by using a number of features in concert, you can substantially improve the security of your network. The following list provides a brief overview of some of the available security features: • Access Control Lists-Access Control Lists (ACLs) are policy files used by the ACL application to perform packet filtering and forwarding decisions on incoming traffic and packets. Each packet arriving on an ingress port is compared to the ACL applied to that port and is either permitted or denied. For more information about using ACLs to control and limit network access, see Chapter 13, ACLs. • Denial of Service Protection-Denial of Service (DoS) protection is a dynamic response mechanism used by the switch to prevent critical network or computing resources from being overwhelmed and rendered inoperative. In essence, DoS protection protects the switch, CPU, and memory from attacks and attempts to characterize the attack (or problem) and filter out the offending traffic so that other functions can continue. If the switch determines it is under attack, the switch reviews the packets in the input buffer and assembles ACLs that automatically stop the offending packets from reaching the CPU. For more information about DoS attacks and DoS protection, see Denial of Service Protection on page 461. • Network Login-Network login controls the admission of user packets and access rights thereby preventing unauthorized access to the network. Network login is controlled on a per port basis. When network login is enabled on a port in a VLAN, that port does not forward any packets until authentication takes place. Network login is capable of three types of authentication: web-based, MAC-based, and 802.1x. For more information about network login, see Chapter 16, Network Login. • Policy Files-Policy files are text files that contain a series of rule entries describing match conditions and actions to take. Policy files are used by both routing protocol applications (routing policies) and the ACL application (ACLs). For more information about policy files, see Chapter 12, Policy Manager. • Routing Policies-Routing policies are policy files used by routing protocol applications to control the advertisement, reception, and use of routing information by the switch. By using policies, a set of routes can be selectively permitted or denied based on their attributes for advertisements in the routing domain. Routing policies can be used to "hide" entire networks or to trust only specific sources for routes or ranges of routes. For more information about using routing policies to control and limit network access, see  Chapter 14, Routing Policies. • sFlow-sFlow® is a technology designed to monitor network traffic by using a statistical sampling of packets received on each port. sFlow also uses IP headers to gather information about the network. By gathering statistics about the network, sFlow becomes an early warning system notifying you when there is a spike in traffic activity. Upon Chapter 17. Security | 435