CN1310467C - Port based network access control method - Google Patents

Abstract

The invention relates to a network access control method based on a network access device port. The method includes: configuring the processing mode of the message passing through the port of the network access device according to the address information of the message; obtaining the address information of the message passing through the port, and processing the message according to the obtained address information and corresponding configuration information to process. The present invention binds the user's source MAC address, source IP address and the corresponding port, and binds the VLAN ID supported by the switch with the member corresponding to the VLAN ID, effectively preventing malicious access or Attack the network. The present invention also restricts the access of the messages entering the network through the network access device port according to the destination address of the messages, including broadcast messages, unicast messages, multicast messages, messages sent to the server, and specific purpose MAC addresses. The network access control of the message of the address effectively prevents legitimate users from forging certain destination MAC addresses to maliciously attack the network.

Description

Port-Based Network Access Control Method

technical field

The invention relates to the technical field of network communication, in particular to a port-based network access control method.

Background technique

With the development of network communication technology, Ethernet has been widely used in people's lives. The network provides great convenience for people's work and life, especially the application of some large and medium-sized enterprise networks, which greatly facilitates the internal users of enterprises. time, and information interaction between internal users and external users.

In the enterprise network, if the Ethernet switch that the user accesses to the network does not provide corresponding security protection functions, the user can access the equipment and resources on the Internet (Internet) as long as the user accesses the Ethernet switch, and constitutes the TCP/IP protocol of the Internet. IP (Transmission Control Protocol/Internet Protocol) itself lacks security and provides an open environment. In this way, the free and extensive application of the network, as well as the "popularity" of hackers, will make network cases face great threats, such as confidentiality. leaks, malicious attacks, etc. For this reason, the Ethernet switch, which is a key device for communication between enterprise internal networks, must provide sufficient security protection functions within the enterprise network to solve network security problems in an open environment.

In view of the above-mentioned needs, existing Ethernet switches all provide multiple network security mechanisms, wherein the address security technology based on ports becomes an important feature of various network case mechanisms, and the described address security technology based on ports refers to Ethernet The network switch controls the transmission of data packets through a certain port accordingly.

The methods currently used to control and restrict access to the network based on ports can be summarized into the following types. These security technologies mainly learn MAC (Media Access Control) addresses by restricting ports, search MAC address tables, software Maintain the MAC address table and binding table check to realize the control of the access network:

1. Support configuration of port learning status: Ethernet switch users can set a port to prohibit learning new MAC addresses according to needs, so that the port only allows the data packets with the static MAC address manually configured by the user as the source MAC address to pass through, while Packets from other MAC addresses will be discarded because the corresponding MAC addresses cannot be learned from the MAC address table;

2. Support setting the maximum number of MAC addresses allowed to be learned by the port: Ethernet switch users configure the number of MAC addresses allowed to be learned by the corresponding port according to actual needs. When the port has learned the number of allowed MAC addresses, it will stop learning new MAC addresses. , the new MAC address cannot be learned until some MAC addresses are aged, so the corresponding Ethernet switch port only allows a set number of access users to access the network and perform normal network access;

3. Support port and MAC address binding: Bind the MAC address to the corresponding port, that is, configure a static MAC address on the port, and prohibit the port from learning the MAC address, thereby limiting the source of the message that is allowed to pass through the port MAC address, packets from other MAC addresses are discarded;

4. Support broadcast message forwarding switch: configure on the port to prohibit the forwarding of messages with the destination address as the broadcast address from the port to prevent Smurf attacks. The Smurf attack described is a network-level attack: hackers broadcast to the network The address sends a large number of IP echo (IP response) requests, and all requests use the IP address of the victim, so that all computers on the network will respond to these requests, and send IP echo request response messages to the victim computer, resulting in network congestion.

The above-mentioned prior art has played a corresponding role in network access control to a certain extent, however, in the specific application process, the above-mentioned various methods still cannot meet the various requirements of network access control, so the above-mentioned prior art still has the following disadvantages:

At present, address counterfeiting can be prevented by configuring static entries in the MAC address table. For example, the above-mentioned solution 1 can be used to prohibit the port from learning the MAC address, or the above-mentioned solution 3 can be used to bind the MAC address to the port. However, the MAC address table The static entries in the table are generally for important MAC addresses. If the MAC addresses from all ports are set as static entries, then on the one hand, the number of self-learning MAC addresses supported by the MAC address table will be greatly reduced. It is not convenient for users who need flexible access; on the other hand, it is also not conducive to users' mobile office needs, that is, when a user moves to another port, if the MAC address is bound to the port, the user will not be able to access the network, so for those who are not Very important MAC addresses are usually not set as static entries, which makes the above solution and solution 3 unable to effectively avoid MAC address counterfeiting.

Although the above scheme 3 limits the number of MAC addresses learned by the corresponding port, that is, limits the number of users accessing the network through a certain port, it still cannot effectively solve the problem of address spoofing.

Solution 4 provided by the prior art can support broadcast message forwarding switch, which can prevent users from sending broadcast messages to carry out network attacks, but when the forwarding of broadcast messages is prohibited according to needs, the forwarding of some special messages may be blocked, such as ARP (Address Resolution Protocol) packets, thus affecting the normal communication of the network.

In addition to the above-mentioned method of controlling and restricting access to the network based on ports, the prior art also provides a network access control method that supports the binding of IP addresses, MAC addresses and VLAN IDs (virtual local area network identification), that is, when When the service access point receives an IP message, the VLAN ID, source MAC address, and source IP address in the Ethernet-encapsulated data packet header must match the VLAN ID, MAC address, and IP address in the binding record, otherwise the message is blocked. considered invalid and discarded.

This solution supports the binding of IP addresses, MAC addresses and VLAN IDs, but it cannot satisfy the requirement that the same user on the same port have different VLAN IDs. For example, the same user on a certain port may belong to different companies or different companies. Generally, the VLAN IDs of different companies or different project teams are different for project teams, so the same user may send data packets with different VLAN IDs. If the VLAN ID is bound to the IP address and MAC address, the normal operation of such users cannot be guaranteed. Use the Internet. Moreover, this scheme can only be applied to frames with IP addresses (IP packets and ARP packets). When sending frames without IP addresses (such as protocol packets), the source IP address cannot be obtained, so Such frames are discarded. In addition, the configuration of this solution is not flexible, and the processing method is single, which cannot meet the needs of different customers. If the customer only requires the binding of the source MAC address, this solution cannot be realized.

It can also be seen from the description of the above prior art that the prior art cannot prevent malicious attacks initiated by users, including malicious attack data packets sent by legal source MAC addresses, especially for attack data packets sent to the server, if not effectively Controlling it will cause the corresponding server to fail to provide corresponding services normally, which will bring great losses to users and network operators; at the same time, the existing technology cannot restrain a specific MAC address from sending and receiving data packets, for example, it is necessary to prohibit If a certain non-paying user continues to send and receive data, the existing technology cannot implement restrictions on the data sending and receiving of the non-paying user.

Contents of the invention

In view of the above-mentioned problems in the prior art, the purpose of the present invention is to provide a port-based network access control method to overcome the shortcomings of the prior art and effectively control network access to users who illegally access the network.

The purpose of the present invention is achieved by the following scheme:

A network access control method based on a network access device port includes:

According to the address information of the message, configure the processing mode of the message passing through the port of the network access device, the processing mode includes whether to allow forwarding, and also set the forwarding mode of the corresponding message for the allowed forwarding situation;

Obtain the address information of the packet passing through the port of the network access device, and find the processing method corresponding to the address information of the packet in the configured processing method of the packet;

Judging whether the processing method is to allow forwarding, if yes, further forwarding according to the forwarding method corresponding to the address information of the message, otherwise, discarding the message.

The network access control method based on the network access device port further includes:

a, configure the user address information of the access user and the corresponding message processing mode for the port of the network access device, and the user address information includes MAC (Media Access Control) address information and/or IP (Internet Protocol) of the access user )Address information;

b. Obtain the user address information carried in the message transmitted through the port of the network access device;

c. Process the message according to the obtained user address information and the processing method of the message corresponding to the user address information configured for the port.

Described step c comprises:

c1, judging whether the acquired MAC address and IP address of the access user match the MAC address and/or IP address of the legal access user configured on the port, if they match, then perform step c3, otherwise, perform step c2;

c2, discarding the message;

c3. Continue the message forwarding process.

Said step a also includes: configuring the corresponding relationship between the VLAN ID (virtual local area network identification) supported by the network access device and the members of the VLAN ID, and the members of the VLAN ID are ports of the network access device.

The configuration information in the step a is saved in two tables, wherein:

The first table includes:

Port information field: used to record the port information that needs to be bound and configured, that is, port number or port list;

MAC address field: used to record the MAC address information corresponding to the corresponding port, that is, to configure the source MAC address of the packets that are allowed to enter the network through the port;

IP address field: used to record the IP address information corresponding to the corresponding port, that is, to configure the source IP address of the packets that are allowed to enter the network through the port;

The second table includes:

VLAN ID field: used to record the VLAN ID information supported by the Ethernet switch;

Port field corresponding to VLAN ID: record one or a group of port information corresponding to the VLAN ID supported by the Ethernet switch.

Described step c3 comprises:

c31, judge whether the VLAN ID of the access user that obtains matches with the VLAN ID that this port supports, if match, then execute step c32, otherwise, execute step c33;

c32, judging whether the port used by the message to enter the network access device is a member of the configured VLANID, if yes, then continue the forwarding process of the message, otherwise, discard the message;

c33. Discard the message.

Described step c33 comprises:

Determine whether the port is set to allow transparent transmission of packets of unknown VLANs, if yes, forward the packets according to the VLAN transparent transmission configuration based on the port, otherwise, discard the packets.

The network access control method based on the network access device port further includes:

d. Configure the processing mode of the message passing through the port according to the destination address of the message forwarded through the port of the network access device;

e. Obtain the destination address information of the message forwarded through the port of the network access device, and perform corresponding processing on the message according to the obtained destination address.

Described step d is:

According to the destination address configuration of the packets forwarded through the port of the network access device, allow or prohibit the forwarding of the packets passing through the port.

Described step d also includes:

Configure the number of packets allowed to be forwarded through the port according to the destination address of the packets forwarded through the port of the network access device.

The destination addresses mentioned include:

Broadcast addresses, unknown unicast addresses, unknown multicast addresses, addresses of servers, and specific MAC addresses.

Described step e comprises:

e1. Obtain the destination address information of the message forwarded through the port of the network access device;

e2, judge whether to allow the message forwarding according to the destination address information obtained and the destination address configured in step d, if allowed, then execute e3, otherwise, discard the message;

e3. Judging whether the number of messages of this type of destination address forwarded by the port exceeds a set value, if so, discarding the messages, otherwise, performing corresponding forwarding processing on the messages.

The corresponding forwarding processing of the message described in step e3 is as follows:

The packet is forwarded according to the packet forwarding processing mode configured on the port for this type of destination address, where:

For broadcast messages, forward them to all ports in the same VLAN in the Ethernet switch;

For unknown unicast packets and unknown multicast packets, forward the packets according to the forwarding destination of this type of packets configured on the port of the Ethernet switch;

For a message sent to a server or a message sent to a specific destination MAC address, the message is forwarded to the corresponding server or the specific destination MAC address.

In the present invention, in order to preserve the corresponding port configuration information in the described steps a and d in the MAC address table, the following fields need to be set respectively in the described MAC address table:

Destination MAC address filtering field: According to this field, determine whether the message needs to be filtered according to the destination MAC address;

Source MAC address filtering field: According to this section, determine whether the packet needs to be filtered according to the source MAC address;

Destination MAC address field: match the destination MAC address of the message that needs to be filtered according to the destination MAC address with the MAC address in this field, and determine the forwarding processing method for the message;

Source MAC address field: match the source MAC address of the message that needs to be filtered according to the source MAC address with the MAC address in this field, and determine the processing method for the message;

Port information field: Match the port of the packet that needs to be filtered according to the source MAC address or destination MAC address into the network access device with the port information in this field, so as to determine that the packet needs to be filtered according to the source MAC address or destination MAC address in the packet. The destination MAC address matches the MAC address information in the source MAC address or destination MAC address field;

The table also needs to set a static entry field: according to this field, it is determined whether the attribute corresponding to the MAC address in the entry can be modified.

As can be seen from the above technical solutions, the present invention binds the user source MAC address, the source IP address and the port of the Ethernet switch, the VLAN ID of the user is bound to the VLAN ID supported by the Ethernet switch, and the port of the Ethernet switch is bound to the user VIAN ID. The corresponding member binding technical solution, therefore, can effectively prevent illegal users who fake source MAC addresses, source IP addresses, and VLAN IDs from maliciously accessing or attacking the network. In the present invention, according to the destination address of the message, corresponding access restrictions are carried out on the message entering the network through the port of the network access device, including broadcast message, unicast message, multicast message, and message sent to the server. And the network access control of the message of specific purpose MAC address, therefore, the present invention can also effectively prevent legitimate users from counterfeiting certain purpose MAC addresses to maliciously attack the network, and control the data sending and receiving of specific users as required The user needs to be shut down, and the user needs to be prohibited from sending and receiving data. At this time, the network administrator only needs to set the destination address filtering and source address filtering corresponding to the MAC address in the MAC address table to meet the corresponding network access control requirements and avoid owed Free users maliciously attack the network or continue to enjoy network services. In addition, the implementation of the present invention can also prevent legitimate users from moving online at will, effectively avoiding the phenomenon that users steal other people's technical data through mobile Internet.

Description of drawings

Fig. 1 is the specific embodiment flowchart of the present invention;

Fig. 2 a is the structural representation of the unicast MAC address table that the present invention establishes;

Fig. 2 b is the structural representation of the multicast MAC address table that the present invention establishes;

Fig. 2c is the structural representation of the table of MAC address, IP address and port binding that the present invention establishes;

Fig. 2 d is the structural representation of the table that the VLAN ID that the present invention establishes and the corresponding member of VLAN ID binds;

Fig. 3 is the specific implementation flowchart of step 12 and step 13 in Fig. 1;

FIG. 4 is a flow chart of a specific implementation of step 14 in FIG. 1 .

Detailed ways

The core idea of the present invention is to perform corresponding network access control according to the source address information and destination address information of the message passing through the port of the network access device, so as to provide guarantee for the security of the network, that is: the network access device will The MAC address, IP address or VLANID of the user connected to the network through the port is bound to the corresponding port. At the same time, the forwarding and processing of the message is controlled and managed according to the destination MAC address of the message, which provides an effective solution for network security. ensure.

The specific embodiment of the present invention is described further now in conjunction with accompanying drawing, at first, referring to Fig. 1, the method of the present invention is described, specifically comprises the following steps:

Step 11: according to the address information of the message entering the network, configure the forwarding processing mode of the message through the port at the port of the network access device (usually an Ethernet switch port);

The address information of the message includes source address information and destination address information, wherein the source address information is the address information of the access user, including: source MAC address information and source IP address information of the message. During the application process, The source MAC address information and source IP address information of legitimate access users can be configured; the destination address information is: the destination MAC address information of the message. During the application process, the destination MAC address information of the message that is restricted to be forwarded can be configured, such as broadcast address, specific purpose MAC address, etc.;

The address information configured above can be saved in the form of a table. For example, a MAC address table containing the following fields can be created on the Ethernet switch to save the corresponding address information, see Figure 2a and Figure 2b, specifically including:

Destination MAC address field: used to record the destination MAC address information, that is, to record the destination MAC address information of the message that is statically configured by the user and enters the network through the corresponding Ethernet switch port. The destination MAC address information is recorded in this field. When the corresponding destination MAC address filtering field is set to valid, the packets whose destination MAC address is the MAC address recorded in this field will be discarded; this field can be unicast MAC address, multicast MAC address, and multicast The port information field corresponding to the MAC address is all ports of the Ethernet switch;

Source MAC address field: used to record the source MAC address information, that is, to record the learned MAC address or the MAC address information of the access user statically configured by the user. A source MAC address is recorded in this field. When the corresponding source MAC address When the address filter field is set to be valid, the message whose source MAC address is the MAC address recorded in this field will be discarded; this field is a field in the existing MAC address table;

Port information field: used to record the port number of the corresponding configuration, that is, all configurations are port-based configurations, and each piece of configuration information needs to correspond to a specific port or a group of ports;

Destination MAC address filtering field: This field is used to record whether to process the packet forwarding processing according to the destination MAC address, that is, when this field is valid, the destination MAC address is the MAC address recorded in the MAC address field corresponding to this field. Address packets are discarded;

Source MAC address filtering field: This field is used to record whether to process the packet forwarding processing according to the source MAC address, that is, when this field is valid, the source MAC address is the MAC address recorded in the MAC address field corresponding to this field. Address packets are discarded;

Static entry field: used to record whether the attribute corresponding to the MAC address in the entry can be modified. When this field is valid, the attributes corresponding to the MAC address in the entry cannot be modified. Attributes include: time stamp, mirror flag, port number, etc. For example, when configuring the corresponding port information field, if you do not want the configured information to be modified, set the field to valid;

In the present invention, a table containing the following fields can also be set to save the MAC address and IP address bound to the port, as shown in Figure 2c, the MAC address and IP address configuration in the table can be set as required, thereby using the present invention to perform For network access control, you can choose to bind ports to MAC addresses, ports to IP addresses, or ports to MAC addresses and IP addresses, etc. to implement them separately. The fields included in the table are:

Port information field: used to record the port information that needs to be bound and configured, that is, port number or port list;

MAC address field: used to record the MAC address information corresponding to the corresponding port, that is, to configure the source MAC address of the packets that are allowed to enter the network through the port;

IP address field: used to record the IP address information corresponding to the corresponding port, that is, to configure the source IP address of the packets that are allowed to enter the network through the port;

When the above table is used to bind the port to the MAC address or to the IP address, it can effectively prevent the user from moving to another port for network access;

In order to further ensure the effective control of incoming packets, it is also possible to configure the forwarding and processing mode of packets passing through the port according to the VLAN ID information of users who access the network through the corresponding port based on the address information of the packets. At the same time, it is also necessary to increase the VLAN ID binding table that contains the VLAN ID field and the member field of the VLAN ID, as shown in Figure 2d, which is used to record the VLANID and VLAN ID member information supported by the Ethernet switch. The members of the VLAN ID are The port of the corresponding Ethernet switch, that is, the port on which the VLAN ID supported by the Ethernet switch is allowed to send out the packet, so that the packet sent by the access user is checked according to its source MAC address and source IP address. On the basis of legitimacy, its legitimacy can also be further checked according to its VLAN ID, thereby further guaranteed the security of network communication; In the present invention, only can also only select port and the VLAN ID binding of legal access user to realize network access control, That is, only use the VLAN ID binding table shown in Figure 2d to record the corresponding content to realize network access control; For network switches, there is no need to configure the forwarding and processing mode of packets passing through the port according to the user's VLAN ID;

Step 12: the message to be sent by the user is connected to the network through the Ethernet switch port, and the source MAC address information and source IP address information of the message are obtained;

Step 13: Determine the processing mode of the message according to the obtained source address MAC information and source IP address information, and perform corresponding processing;

That is: match the obtained source MAC information and source IP address information with the corresponding source address MAC information and source IP address information configured on the port, and determine the forwarding and processing mode of the packet according to the matching result, or normal The message is forwarded, or the message is discarded, or step 14 is performed, and the forwarding processing method of the message is further identified according to the destination MAC address;

When the port is configured with the source MAC address information and source IP address information of the legal access user, then when the matching is passed, the VLAN ID check and the destination MAC address check of the next step are carried out.

Get the VLAN ID information in the message, and further determine the forwarding processing method for the message according to the user's VLAN ID configuration. otherwise, discard the message;

Step 14: Obtain the destination MAC address information in the message entering the network through the port of the Ethernet switch, and determine the forwarding processing method of the message according to the destination MAC address;

When it is determined according to the configuration information of the port that the message passing through the port needs to be filtered according to the destination MAC address, the destination MAC address in the message is obtained, and the obtained destination MAC address is compared with the above-mentioned MAC address table. The destination MAC address field in the item matches, and determines the forwarding processing mode of the packet according to the matching result.

Through the processing from step 11 to step 14, it can be seen that the present invention realizes corresponding network access control based on ports for users accessing the network, that is, forwarding of messages sent by users accessing the network via Ethernet switch ports The processing method is limited accordingly.

Among them, the essence of the processing procedure described in step 12 and step 13 is: determine the forwarding processing method of the message according to the address information of the access user and/or the VLAN ID information of the access user, that is, the address information of the user and/or the VLAN ID information of the access user The user's VLAN ID information is bound to the Ethernet switch port used by the user to access the network, and the message entering the network through the Ethernet switch port is forwarded accordingly according to the address information of the access user who sent the message Processing, the address information includes the MAC address and IP address of the user, the VLAN ID information of the access user is optionally bound to the port, and the address information of the legal user is connected to the corresponding port on the Ethernet switch port. Port binding, at the same time, the VLAN ID information of the access user is bound to the VLAN ID supported by the Ethernet switch, and the port is bound to the VLAN ID of the access user. The number of bound users can be set as required. In this way, by checking the port The address information of the user bound to the Internet and the VLAN ID information of the access user can determine the forwarding and processing mode of the message entering the network from the port. Firstly, step 12 and step 13 described above will be further explained below in conjunction with Figure 3, so as to bind the MAC address and IP address of the access user to the corresponding port, and the VLAN ID and VLAN ID members supported by the Ethernet switch Binding, the members of the VLAN ID are each port of the corresponding Ethernet switch, usually the members of the VLAN ID are expressed in the form of a port list, and specifically include the following steps:

Step 31: The message sent by the access user enters the network from the Ethernet switch port, and obtains the source MAC address and source IP address of the message;

Step 32: Match the obtained source MAC address and source IP address with the source MAC address and source IP address information in the user address information bound on the port of the Ethernet switch. If they match, then for the user address information of the packet If the check is passed, go to step 34; otherwise, if the user address information check for the packet fails, go to step 33

Step 33: Determine that the message is an illegal message, and discard the message;

Step 34: further carry out the legal inspection of the VLAN ID, that is, obtain the VLAN ID carried in the message entering the network;

Step 35: Match the obtained VLAN ID with the VLAN ID information bound on the Ethernet switch, and judge whether the matching is passed, if the matching is passed, execute step 36, otherwise, execute step 38;

Step 36: further determine whether the port list corresponding to the matching VLAN ID includes the port, that is, the port used when the message enters the network, if the port is included, the VLAN ID check for the message is passed, and step 37 is performed, otherwise , the VLAN ID check for the packet fails, go to step 33;

Step 37: Perform normal forwarding processing on the message, that is, determine the destination forwarding port by searching the MAC address table, and forward the message through the determined port;

Usually, if it is not necessary to carry out the destination address check in step 14 mentioned above, then the normal forwarding process can be directly carried out on the message, if it is necessary to perform step 14 to check whether the destination address of the message is further legal, then Need to go to step 14;

Step 38: Determine whether the Ethernet switch port supports VLAN transparent transmission, if it supports, then perform step 39, otherwise, perform step 33;

Whether the Ethernet switch port supports VLAN transparent transmission can be configured by the user according to the needs. If it supports VLAN LAN transparent transmission, the user also needs to configure the corresponding transparent transmission forwarding mode according to the needs, and forward the packets that need to be transparently transmitted according to the configured forwarding mode. Penetrate;

In the current communication system, in order to save the resources of the Ethernet switch, it is usually only allowed to support a certain number of VLAN IDs. For the data packets of the VLAN IDs that the Ethernet switch does not support, in order to ensure that the user can normally send and receive the corresponding data packets, it is necessary to The Ethernet switch supports transparent transmission of this type of data packet; for the case where the user's VLAN ID is not in the VLAN ID supported by the Ethernet switch, whether to allow transparent transmission of this type of packet is usually configurable based on the Ethernet switch port.

Step 39: forward the message according to the forwarding mode of the VLAN transparent transmission configuration on the port of the Ethernet switch.

The essence of the processing process of step 14 in FIG. 1 is: determine the corresponding forwarding processing method for the message sent by the access network user according to the destination address information carried in the message, and process the message according to the determined forwarding processing method. For realizing this scheme at first needs to configure the destination MAC address and the forwarding processing mode of corresponding message on Ethernet switch port, described destination MAC address can be broadcast address, unicast address, multicast address, server address, specific MAC address, so that the corresponding access control can be performed on the message according to the destination MAC address of the message entering the network through the Ethernet switch port, for example, to control the forwarding processing mode of the broadcast message, or to limit the forwarding of the broadcast message, Or limit the forwarding number of broadcast packets, and so on. See Figure 4 for details, including the following steps:

Step 41: Determining that the packets entering the network through the port of the Ethernet switch need to be filtered by the destination MAC address;

Step 42: Obtain the destination MAC address carried in the message;

Step 43: Find the forwarding processing mode of the message configured on the port of the Ethernet switch according to the destination MAC address information of the obtained message;

Step 44: judging whether the forwarding processing method of the message is discarding, if yes, then perform step 45, otherwise, perform step 46;

Step 45: Discard the message;

Step 46: judging whether the number of packets of the destination MAC address normally processed by the Ethernet switch port exceeds a set value, if exceeded, then perform step 45, otherwise, perform step 47;

Step 47: Carry out forwarding processing on the message according to the forwarding mode of the message configured on the port of the Ethernet switch, including:

For a broadcast message, forward the message to all ports in the same VLAN in the Ethernet switch;

For unknown unicast packets and unknown multicast packets, the packet is forwarded according to the forwarding destination address of this type of packet configured on the port of the Ethernet switch;

For a message sent to a server or a message sent to a specific destination MAC address, the message is forwarded to the corresponding server or the specific destination MAC address.

In the present invention, the network access control for the message destination MAC address can be selected and set according to needs, that is, the network access control function for the message destination MAC address is enabled or disabled according to needs. The present invention provides the network access control functions for the destination MAC address in broadcast messages, unknown unicast messages, unknown multicast messages, messages sent to servers, and messages sent to specific MAC addresses, and each function can Each is enabled or disabled independently.

Claims (15)

1, a kind of method for network access control of access device port Network Based is characterized in that comprising:

According to the address information of message, configuration is through the processing mode of the message of network access equipment port, and described processing mode comprises whether allowing to transmit, and for allowing the forwarding situation that corresponding message forwarding mode also is set;

Obtain address information, in the processing mode of the message that disposes, search the processing mode of the address information correspondence of this message through the message of network access equipment port;

Judge that whether described processing mode is to allow to transmit, if, then further transmit according to the pass-through mode of the address information correspondence of this message, otherwise, described message abandoned.

2, the method for network access control of access device port Network Based according to claim 1 is characterized in that this method further comprises:

A, be that the network access equipment port arrangement inserts user's station address information and corresponding message processing mode, described station address information comprises medium access control mac address information and/or the IP address information that inserts the user;

B, obtain the station address information of in the message that the network access equipment port transmission is come, carrying;

C, described message is handled according to the station address information obtained and for the processing mode of the message of the station address information correspondence of this port arrangement.

3, the method for network access control of access device port Network Based according to claim 2 is characterized in that described step c comprises:

Whether mate for the legal access user's of this port arrangement MAC Address and/or IP address c1, the MAC Address of judging the access user obtain and IP address, if coupling, execution in step c3 then, otherwise, execution in step c2;

C2, abandon this message;

C3, continuation message forwarding processing procedure.

4, according to the method for network access control of claim 2 or 3 described access device ports Network Based, it is characterized in that described step a also comprises: VLAN ID VLAN ID that the configuration network access device is supported and the member's of VLAN ID corresponding relation, the member of described VLAN ID is the port of network access equipment.

5, the method for network access control of access device port Network Based according to claim 4 is characterized in that the configuration information among the described step a adopts preserving of two tables, wherein:

First table comprises:

Port information field: be used to write down and bind the port information of configuration, i.e. port numbers or port list to it;

The MAC Address field: be used to write down the mac address information corresponding with the corresponding port, i.e. configuration allows to enter through this port the source MAC of the message of network;

IP address field: be used to write down the IP address information corresponding with the corresponding port, i.e. configuration allows to enter through this port the source IP address of the message of network;

Second table comprises:

VLAN id field: be used to write down the VLAN id information that Ethernet switch is supported;

VLAN ID corresponding port field: write down corresponding or one group of port information of VLAN ID of supporting with Ethernet switch.

6, the method for network access control of access device port Network Based according to claim 4 is characterized in that described step c3 comprises:

C31, judge the access user's obtain VLAN ID with for whether the VLAN ID of this port support mates, if mate, execution in step c32 then, otherwise, execution in step c33;

C32, judge that this message enters the member whether employed port of network access equipment is the VLAN ID of configuration, if, then continue the message forwarding processing procedure, otherwise, this message abandoned;

C33, abandon this message.

7, the method for network access control of access device port Network Based according to claim 6 is characterized in that described step c33 comprises:

Judge whether this port is set to allow transparent transmission for the message of unknown VLAN, if, then carry out message forwarding according to VLAN transparent transmission configuration mode based on this port, otherwise, this message abandoned.

8, the method for network access control of access device port Network Based according to claim 1 and 2 is characterized in that this method further comprises:

D, according to the destination address configuration of the message of transmitting through the network access equipment port processing mode through the message of this port;

E, obtain the destination address information of the message of transmitting through the network access equipment port, and this message is handled accordingly according to the destination address that obtains.

9, the method for network access control of access device port Network Based according to claim 8 is characterized in that described steps d is:

Allow or forbid transmitting the message of this port of process according to the destination address configuration of the message of transmitting through the network access equipment port.

10, the method for network access control of access device port Network Based according to claim 9 is characterized in that described steps d also comprises:

Destination address configuration according to the message of transmitting through the network access equipment port allows the quantity of forwarding through the message of this port.

11, the method for network access control of access device port Network Based according to claim 8 is characterized in that described destination address comprises:

The address of broadcast address, unknown unicast address, unknown multicast address, server and specific MAC Address.

12, the method for network access control of access device port Network Based according to claim 11 is characterized in that described step e comprises:

E1, obtain the destination address information of the message of transmitting through the network access equipment port;

The destination address of destination address information that e2, basis are obtained and steps d configuration judges whether to allow this message to transmit, if allow, then carries out e3, otherwise, abandon this message;

E3, judge whether the quantity of the message of this kind destination address that this port is transmitted surpasses the numerical value of setting, if surpass, then abandons this message, otherwise, this message is transmitted processing accordingly.

13, the method for network access control of access device port Network Based according to claim 12 is characterized in that described this message is transmitted accordingly of step e3 is treated to:

This message is transmitted processing according to the message forwarding processing mode to the type destination address that disposes in this port, wherein:

For broadcasting packet, all of the port is transmitted in the same VLAN in Ethernet switch;

For unknown unicast message and unknown multicast message, carry out message forwarding according to the type message forwarding destination that disposes on this ethernet switch port;

For the message that mails to server or mail to the message of specific purpose MAC Address, then message is forwarded to corresponding server or specific target MAC (Media Access Control) address.

14, the method for network access control of access device port Network Based according to claim 8, it is characterized in that:, following field need be set respectively in described mac address table in mac address table, preserving corresponding ports configuration information among described step a and the d:

Target MAC (Media Access Control) address filtered fields: determine according to this field whether needs filter according to target MAC (Media Access Control) address message;

The source MAC address filtering field: whether needs filter according to source MAC according to the definite message of this section;

Target MAC (Media Access Control) address field: will determine that the target MAC (Media Access Control) address of the message that need filter according to target MAC (Media Access Control) address and the MAC Address in this field mate, and determine at this message forwarding processing mode;

Source MAC field: will determine that the source MAC of the message that need filter according to source MAC and the MAC Address in this field mate, and determine processing mode at this message;

The port information field: will determine to enter the port of network access equipment and the port information in this field mates according to the message that source MAC or target MAC (Media Access Control) address filter, thereby determine need with the source MAC in this message or the mac address information that is arranged in source MAC or target MAC (Media Access Control) address field of target MAC (Media Access Control) address coupling;

15, the method for network access control of access device port Network Based according to claim 14 is characterized in that also needing in the described table to be provided with the static entry field: whether the attribute of determining the MAC Address correspondence in the list item according to this field can be revised.

Images