Home » TP-Link Manuals » Hubs & Switches » TP-Link T2600G-18TSTL-SG3216 » Manual Viewer

TP-Link T2600G-18TSTL-SG3216 T2600G-18TSUN V1 Configuration Guide - Page 750

ARP Inspection, ND Detection

View all TP-Link T2600G-18TSTL-SG3216 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 750 highlights

Configuring Network Security Network Security ARP Inspection In an actual complex network, there are high security risks during ARP implementation procedure. The cheating attacks against ARP, such as imitating gateway, cheating gateway, cheating terminal hosts and ARP flooding attack, frequently occur to the network. ARP Inspection can prevent the network from these ARP attacks.  Prevent ARP Cheating Attacks Based on the predefined IP-MAC Binding entries, the ARP Inspection can be configured to detect the ARP packets and filter the illegal ones so as to prevent the network from ARP cheating attacks.  Prevent ARP Flooding Attack With the ARP Defend feature the switch can terminate receiving the ARP packets for 300 seconds when the transmission speed of the legal ARP packet on the port exceeds the defined value so as to avoid ARP flooding attack. ND Detection Because of the absence of security mechanism, IPv6 ND (Neighbor Discovery) protocol is easy to be exploited by attackers. ND detection feature uses the entries in the IPv6-MAC binding table to filter the forged ND packets and prevent the ND attacks. The application topology of ND Detection is as the following figure shows. the port that is connected to the gateway should be configured as trusted port, and other ports should be configured as untrusted ports. The forwarding principles of ND packets are as follows:  All ND packets received on the trusted port will be forwarded without checked.  RS (Router Solicitation) and NS (Neighbor Solicitation) packets with their source IPv6 addresses unspecified, such as the RS packet for IPv6 address request and the NS packet for duplicate address detection, will not be checked on both kinds of ports.  RA (Router Advertisement) and RR (Router Redirect) packets received on the untrusted port will be discarded directly, and other ND packets will be checked: The switch will use the IPv6-MAC binding table to compare the IPv6 address, MAC address, VLAN ID and receiving port between the entry and the ND packet. If a match is found, the ND packet is considered legal and will be forwarded; if no match is found, the ND packet is considered illegal and will be discarded. Configuration Guide 720

Section	Page
About This Guide	31
Intended Readers	31
Conventions	31
More Information	32
Accessing the Switch	33
Overview	34
Web Interface Access	35
Login	35
Save Config Function	36
Disable the Web Server	37
Configure the Switch's IP Address and Default Gateway	38
Command Line Interface Access	41
Console Login (only for switch with console port)	41
Telnet Login	43
SSH Login	44
Disable Telnet login	48
Disable SSH login	49
Copy running-config startup-config	49
Change the Switch's IP Address and Default Gateway	50
Managing System	51
System	52
Overview	52
Supported Features	52
System Info Configurations	54
Using the GUI	54
Viewing the System Summary	54
Specifying the Device Description	56
Setting the System Time	56
Setting the Daylight Saving Time	58
Specifying the Serial Port Parameter	59
Using the CLI	60
Viewing the System Summary	60
Specifying the Device Description	61
Setting the System Time	62
Setting the Daylight Saving Time	64
Specifying the Serial Port Parameter	66
User Management Configurations	68
Using the GUI	68
Creating Admin Accounts	68
Creating Accounts of Other Types	69
Using the CLI	71
Creating Admin Accounts	71
Creating Accounts of Other Types	72
System Tools Configurations	76
Using the GUI	76
Configuring the Boot File	76
Restoring the Configuration of the Switch	77
Backing up the Configuration File	78
Upgrading the Firmware	78
Configuring Auto Install Function	79
Rebooting the switch	80
Configuring the Reboot Schedule	80
Reseting the Switch	81
Using the CLI	81
Configuring the Boot File	81
Restoring the Configuration of the Switch	82
Backing up the Configuration File	83
Upgrading the firmware	83
Configuring Auto Install Function	84
Rebooting the switch	85
Configuring the Reboot Schedule	86
Reseting the Switch	87
Access Security Configurations	88
Using the GUI	88
Configuring the Access Control Feature	88
Configuring the HTTP Function	90
Configuring the HTTPS Function	91
Configuring the SSH Feature	93
Enabling the Telnet Function	94
Using the CLI	94
Configuring the Access Control	94
Configuring the HTTP Function	96
Configuring the HTTPS Function	97
Configuring the SSH Feature	99
Enabling the Telnet Function	102
SDM Template Configuration	103
Using the GUI	103
Using the CLI	104
Appendix: Default Parameters	106
Managing Physical Interfaces	109
Physical Interface	110
Overview	110
Supported Features	110
Basic Parameters Configurations	111
Using the GUI	111
Using the CLI	112
Port Mirror Configuration	115
Using the GUI	115
Using the CLI	117
Port Security Configuration	119
Using the GUI	119
Using the CLI	120
Port Isolation Configurations	123
Using the GUI	123
Using the CLI	124
Loopback Detection Configuration	126
Using the GUI	126
Using the CLI	127
Configuration Examples	130
Example for Port Mirror	130
Network Requirements	130
Configuration Scheme	130
Using the GUI	130
Using the CLI	132
Example for Port Isolation	132
Network Requirements	132
Configuration Scheme	133
Using the GUI	133
Using the CLI	134
Example for Loopback Detection	135
Network Requirements	135
Configuration Scheme	135
Using the GUI	135
Using the CLI	136
Appendix: Default Parameters	138
Configuring LAG	140
LAG	141
Overview	141
Supported Features	141
LAG Configuration	142
Using the GUI	143
Configuring Load-balancing Algorithm	143
Configuring Static LAG or LACP	144
Using the CLI	146
Configuring Load-balancing Algorithm	146
Configuring Static LAG or LACP	147
Configuration Example	151
Network Requirements	151
Configuration Scheme	151
Using the GUI	152
Using the CLI	153
Appendix: Default Parameters	155
Monitoring Traffic	156
Traffic Monitor	157
Using the GUI	157
Viewing the Traffic Summary	157
Viewing the Traffic Statistics in Detail	158
Using the CLI	160
Appendix: Default Parameters	161
Managing MAC Address Table	162
MAC Address Table	163
Overview	163
Supported Features	163
Address Configurations	165
Using the GUI	165
Adding Static MAC Address Entries	165
Modifying the Aging Time of Dynamic Address Entries	167
Adding MAC Filtering Address Entries	168
Viewing Address Table Entries	168
Using the CLI	169
Adding Static MAC Address Entries	169
Modifying the Aging Time of Dynamic Address Entries	170
Adding MAC Filtering Address Entries	171
Security Configurations	173
Using the GUI	173
Configuring MAC Notification Traps	173
Limiting the Number of MAC Addresses in VLANs	175
Using the CLI	176
Configuring MAC Notification Traps	176
Limiting the Number of MAC Addresses in VLANs	177
Example for Security Configurations	179
Network Requirements	179
Configuration Scheme	179
Using the GUI	180
Using the CLI	181
Appendix: Default Parameters	182
Configuring DDM	183
Overview	184
DDM Configuration	185
Using the GUI	185
Configuring DDM Globally	185
Configuring the Temperature Threshold	186
Configuring the Voltage Threshold	186
Configuring the Bias Current Threshold	187
Configuring the Tx Power Threshold	188
Configuring the Rx Power Threshold	189
Viewing DDM Status	189
Using the CLI	190
Configuring DDM Globally	190
Configuring DDM Shutdown	191
Configuring Temperature Threshold	192
Configuring Voltage Threshold	193
Configuring Bias Current Threshold	194
Configuring Tx Power Threshold	196
Configuring Rx Power Threshold	197
Viewing DDM Configuration	198
Viewing DDM Status	199
Appendix: Default Parameters	200
Configuring L2PT	201
Overview	202
L2PT Configuration	204
Using the GUI	204
Using the CLI	205
Configuration Example	208
Network Requirements	208
Configuration Scheme	208
Using the GUI	208
Using the CLI	209
Appendix: Default Parameters	211
Configuring 802.1Q VLAN	212
Overview	213
802.1Q VLAN Configuration	214
Using the GUI	214
Configuring the PVID of the Port	214
Configuring the VLAN	216
Using the CLI	217
Creating a VLAN	217
Configuring the Port	218
Adding the Port to the Specified VLAN	219
Configuration Example	221
Network Requirements	221
Configuration Scheme	221
Network Topology	222
Using the GUI	222
Using the CLI	225
Appendix: Default Parameters	227
Configuring MAC VLAN	228
Overview	229
MAC VLAN Configuration	230
Using the GUI	230
Configuring 802.1Q VLAN	230
Binding the MAC Address to the VLAN	231
Enabling MAC VLAN for the Port	231
Using the CLI	232
Configuring 802.1Q VLAN	232
Binding the MAC Address to the VLAN	232
Enabling MAC VLAN for the Port	233
Configuration Example	235
Network Requirements	235
Configuration Scheme	235
Using the GUI	236
Using the CLI	240
Appendix: Default Parameters	243
Configuring Protocol VLAN	244
Overview	245
Protocol VLAN Configuration	246
Using the GUI	246
Configuring 802.1Q VLAN	246
Creating Protocol Template	247
Configuring Protocol VLAN	248
Using the CLI	248
Configuring 802.1Q VLAN	248
Creating a Protocol Template	249
Configuring Protocol VLAN	250
Configuration Example	252
Network Requirements	252
Configuration Scheme	252
Using the GUI	253
Using the CLI	259
Appendix: Default Parameters	264
Configuring VLAN-VPN	265
VLAN-VPN	266
Overview	266
Supported Features	267
Basic VLAN-VPN Configuration	268
Using the GUI	268
Configuring 802.1Q VLAN	268
Configuring Global VLAN-VPN and Up-link Ports	268
Configuring VPN Ports	269
Using the CLI	270
Configuring 802.1Q VLAN	270
Configuring Basic VLAN-VPN	270
Flexible VLAN-VPN Configuration	273
Using the GUI	273
Using the CLI	274
Configuration Example	276
Network Requirements	276
Configuration Scheme	276
Using the GUI	277
Using the CLI	280
Appendix: Default Parameters	283
Configuring GVRP	284
Overview	285
GVRP Configuration	286
Using the GUI	286
Using the CLI	288
Configuration Example	291
Network Requirements	291
Configuration Scheme	291
Using the GUI	292
Using the CLI	295
Appendix: Default Parameters	299
Configuring Private VLAN	300
Overview	301
Private VLAN Configurations	303
Using the GUI	303
Creating Private VLAN	303
Configuring the Up-link Port	304
Configuring the Down-link Port	305
Using the CLI	306
Creating Private VLAN	306
Configuring the Up-link Port	308
Configuring the Down-link Port	309
Configuration Example	311
Network Requirements	311
Configuration Scheme	311
Network Topology	311
Using the GUI	312
Using the CLI	314
Appendix: Default Parameters	317
Configuring Spanning Tree	318
Spanning Tree	319
Overview	319
Basic Concepts	319
STP/RSTP Concepts	319
MSTP Concepts	323
STP Security	324
STP/RSTP Configurations	327
Using the GUI	327
Configuring STP/RSTP Parameters on Ports	327
Configuring STP/RSTP Globally	329
Verifying the STP/RSTP Configurations	331
Using the CLI	332
Configuring STP/RSTP Parameters on Ports	332
Configuring Global STP/RSTP Parameters	334
Enabling STP/RSTP Globally	335
MSTP Configurations	337
Using the GUI	337
Configuring Parameters on Ports in CIST	337
Configuring the MSTP Region	339
Configuring MSTP Globally	344
Verifying the MSTP Configurations	346
Using the CLI	347
Configuring Parameters on Ports in CIST	347
Configuring the MSTP Region	349
Configuring Global MSTP Parameters	352
Enabling Spanning Tree Globally	354
STP Security Configurations	357
Using the GUI	357
Configuring the STP Security	357
(Optional) Configuring the Threshold and TC Protect Cycle	358
Using the CLI	359
Configuring the STP Security	359
Configuring the TC Protect	361
Configuration Example for MSTP	363
Network Requirements	363
Configuration Scheme	363
Using the GUI	364
Using the CLI	375
Appendix: Default Parameters	382
Configuring OAM	384
Ethernet OAM	385
Overview	385
Supported Features	386
Ethernet OAM Configurations	389
Using the GUI	389
Enabling OAM and Configuring OAM Mode	389
Configuring Link Monitoring	390
Configuring RFI	392
Configuring Remote Loopback	393
Viewing OAM Status	394
Using the CLI	396
Enabling OAM and Configuring OAM Mode	396
Configuring Link Monitoring	397
Configuring Remote Failure Indication	403
Configuring Remote Loopback	404
Verifying OAM Connection	405
Viewing OAM Statistics	408
Using the GUI	408
Viewing OAMPDUs	408
Viewing Event Logs	410
Using the CLI	411
Viewing OAMPDUs	411
Viewing Event Logs	413
Configuration Example	415
Network Requirements	415
Configuration Scheme	415
Using the GUI	415
Using the CLI	420
Appendix: Default Parameters	425
Configuring Layer 2 Multicast	426
Layer 2 Multicast	427
Overview	427
Supported Layer 2 Multicast Protocols	428
IGMP Snooping Configurations	429
Using the GUI	429
Configuring IGMP Snooping Globally	429
Enabling IGMP Snooping Globally	429
(Optional) Configuring Unknown Multicast	429
(Optional) Configuring Report Message Suppression	430
Configuring Router Port Time and Member Port Time	430
Configuring IGMP Snooping Last Listener Query	431
Verifying IGMP Snooping Status	431
Configuring the Port’s Basic IGMP Snooping Features	432
Enabling IGMP Snooping on the Port	432
(Optional) Configuring Fast Leave	432
Configuring IGMP Snooping in the VLAN	433
Configuring IGMP Snooping Globally in the VLAN	433
(Optional) Configuring the Static Router Ports in the VLAN	434
(Optional) Configuring the Forbidden Router Ports in the VLAN	434
Configuring the Multicast VLAN	434
Creating Multicast VLAN and Configuring Basic Settings	435
(Optional) Creating Replace Source IP	436
Viewing Dynamic Router Ports in the Multicast VLAN	436
(Optional) Configuring the Static Router Ports	436
(Optional) Configuring the Forbidden Router Ports	436
(Optional) Configuring the Querier	437
Configuring the Querier	437
Viewing Settings of IGMP Querier	437
Configuring IGMP Profile	438
Creating Profile	438
Searching Profile	438
Editing IP Range of the Profile	439
Binding Profile and Member Ports	439
Binding Profile and Member Ports	440
Configuring Max Groups a Port Can Join	440
Viewing IGMP Statistics on Each Port	441
Configuring Auto Refresh	441
Viewing IGMP Statistics	442
Enabling IGMP Accounting and Authentication	442
Configuring IGMP Accounting Globally	443
Configuring IGMP Authentication on the Port	443
Configuring Static Member Port	443
Configuring Static Member Port	444
Viewing IGMP Static Multicast Groups	444
Using the CLI	445
Enabling IGMP Snooping Globally	445
Enabling IGMP Snooping on the Port	445
Configuring IGMP Snooping Parameters Globally	446
Configuring Report Message Suppression	446
Configuring Unknown Multicast	447
Configuring IGMP Snooping Parameters on the Port	448
Configuring Router Port Time and Member Port Time	448
Configuring Fast Leave	449
Configuring Max Group and Overflow Action on the Port	450
Configuring IGMP Snooping Last Listener Query	451
Configuring IGMP Snooping Parameters in the VLAN	453
Configuring Router Port Time and Member Port Time	453
Configuring Static Router Port	454
Configuring Forbidden Router Port	455
Configuring Static Multicast (Multicast IP and Forward Port)	456
Configuring IGMP Snooping Parameters in the Multicast VLAN	456
Configuring Router Port Time and Member Port Time	456
Configuring Static Router Port	457
Configuring Forbidden Router Port	458
Configuring Replace Source IP	459
Configuring the Querier	460
Enabling IGMP Querier	460
Configuring Query Interval, Max Response Time and General Query Source IP	461
Configuring Multicast Filtering	462
Creating Profile	462
Binding Profile to the Port	463
Enabling IGMP Accounting and Authentication	465
Enabling IGMP Authentication on the Port	465
Enabling IGMP Accounting Globally	466
Configuring MLD Snooping	467
Using the GUI	467
Configuring MLD Snooping Globally	467
Enabling MLD Snooping Globally	467
(Optional) Configuring Unknown Multicast	467
(Optional) Configuring Report Message Suppression	468
Configuring Router Port Time and Member Port Time	468
Configuring MLD Snooping Last Listener Query	469
Verifying MLD Snooping Status	469
Configuring the Port’s Basic MLD Snooping Features	470
Enabling MLD Snooping on the Port	470
(Optional) Configuring Fast Leave	470
Configuring MLD Snooping in the VLAN	471
Configuring MLD Snooping Globally in the VLAN	471
(Optional) Configuring the Static Router Ports in the VLAN	472
(Optional) Configuring the Forbidden Router Ports in the VLAN	472
Configuring the Multicast VLAN	472
Creating Multicast VLAN and Configuring Basic Settings	473
(Optional) Creating Replace Source IP	474
Viewing Dynamic Router Ports in the Multicast VLAN	474
(Optional) Configuring the Static Router Ports	474
(Optional) Configuring the Forbidden Router Ports	474
(Optional) Configuring the Querier	475
Configuring the Querier	475
Viewing Settings of MLD Querier	475
Configuring MLD Profile	476
Creating Profile	476
Searching Profile	476
Editing IP Range of the Profile	477
Binding Profile and Member Ports	478
Binding Profile and Member Ports	478
Configuring Max Groups a Port Can Join	479
Viewing MLD Statistics on Each Port	480
Configuring Auto Refresh	480
Viewing MLD Statistics	480
Configuring Static Member Port	481
Configuring Static Member Port	481
Viewing MLD Static Multicast Groups	481
Using the CLI	482
Enabling MLD Snooping Globally	482
Enabling MLD Snooping on the Port	482
Configuring MLD Snooping Parameters Globally	483
Configuring Report Message Suppression	483
Configuring Unknown Multicast	484
Configuring MLD Snooping Parameters on the Port	485
Configuring Router Port Time and Member Port Time	485
Configuring Fast Leave	486
Configuring Max Group and Overflow Action on the Port	487
Configuring MLD Snooping Last Listener Query	488
Configuring MLD Snooping Parameters in the VLAN	489
Configuring Router Port Time and Member Port Time	489
Configuring Static Router Port	490
Configuring Forbidden Router Port	491
Configuring Static Multicast (Multicast IP and Forward Port)	492
Configuring MLD Snooping Parameters in the Multicast VLAN	493

Match case Limit results 1 per page

Configuration Guide

720

Configuring Network Security

Network Security

ARP Inspection

In an actual complex network, there are high security risks during ARP implementation

procedure. The cheating attacks against ARP, such as imitating gateway, cheating gateway,

cheating terminal hosts and ARP flooding attack, frequently occur to the network. ARP

Inspection can prevent the network from these ARP attacks.



Prevent ARP Cheating Attacks

Based on the predefined IP-MAC Binding entries, the ARP Inspection can be configured to

detect the ARP packets and filter the illegal ones so as to prevent the network from ARP

cheating attacks.



Prevent ARP Flooding Attack

With the ARP Defend feature the switch can terminate receiving the ARP packets for 300

seconds when the transmission speed of the legal ARP packet on the port exceeds the

defined value so as to avoid ARP flooding attack.

ND Detection

Because of the absence of security mechanism, IPv6 ND (Neighbor Discovery) protocol is

easy to be exploited by attackers. ND detection feature uses the entries in the IPv6-MAC

binding table to filter the forged ND packets and prevent the ND attacks.

The application topology of ND Detection is as the following figure shows. the port that is

connected to the gateway should be configured as trusted port, and other ports should be

configured as untrusted ports. The forwarding principles of ND packets are as follows:



All ND packets received on the trusted port will be forwarded without checked.



RS (Router Solicitation) and NS (Neighbor Solicitation) packets with their source IPv6

addresses unspecified, such as the RS packet for IPv6 address request and the NS

packet for duplicate address detection, will not be checked on both kinds of ports.



RA (Router Advertisement) and RR (Router Redirect) packets received on the untrusted

port will be discarded directly, and other ND packets will be checked: The switch will

use the IPv6-MAC binding table to compare the IPv6 address, MAC address, VLAN ID

and receiving port between the entry and the ND packet. If a match is found, the ND

packet is considered legal and will be forwarded; if no match is found, the ND packet is

considered illegal and will be discarded.