Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 385)

22-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 22 Configuring ARP Inspection and Bridging Parameters

Customizing the MAC Address Table

This section describes the MAC address table, and includes the following topics:

• MAC Address Table Overview, page 22-3

• Adding a Static MAC Address, page 22-3

• Setting the MAC Address Timeout, page 22-3

• Disabling MAC Address Learning, page 22-4

• Viewing the MAC Address Table, page 22-4

MAC Address Table Overview

The security appliance learns and builds a MAC address table in a similar way as a normal bridge or

switch: when a device sends a packet through the security appliance, the security appliance adds the

MAC address to its table. The table associates the MAC address with the source interface so that the

security appliance knows to send any packets addressed to the device out the correct interface.

Because the security appliance is a firewall, if the destination MAC address of a packet is not in the table,

the security appliance does not flood the original packet on all interfaces as a normal bridge does.

Instead, it generates the following packets for directly connected devices or for remote devices:

• Packets for directly connected devices—The security appliance generates an ARP request for the

destination IP address, so that the security appliance can learn which interface receives the ARP

response.

• Packets for remote devices—The security appliance generates a ping to the destination IP address

so that the security appliance can learn which interface receives the ping reply.

The original packet is dropped.

Adding a Static MAC Address

Normally, MAC addresses are added to the MAC address table dynamically as traffic from a particular

MAC address enters an interface. You can add static MAC addresses to the MAC address table if desired.

One benefit to adding static entries is to guard against MAC spoofing. If a client with the same

MAC address as a static entry attempts to send traffic to an interface that does not match the static entry,

then the security appliance drops the traffic and generates a system message.

To add a static MAC address to the MAC address table, enter the following command:

hostname(config)# mac-address-table static

interface_name mac_address

The interface_name is the source interface.

Setting the MAC Address Timeout

The default timeout value for dynamic MAC address table entries is 5 minutes, but you can change the

timeout. To change the timeout, enter the following command:

hostname(config)# mac-address-table aging-time

timeout_value

The timeout_value (in minutes) is between 5 and 720 (12 hours). 5 minutes is the default.

1 2 ... 380 381 382 383 384 385 386 387 388 389 390 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 385