Network security support
3.6
Restrict logical access to your network
48
UM Security BRS-2A
Release
8.7
05/2022
3.6
Restrict logical access to your network
3.6.1
Configure a dedicated management VLAN
If you have already set up a dedicated management VLAN, you can skip this chapter. Else follow
the description
(see on page 29 “Configure a VLAN dedicated to management access.”)
.
Note:
If you use certain redundancy protocols, use only VLAN IDs ≥2 for payload traffic and device
management
(see on page 21 “VLAN plan considerations depending on redundancy protocols”)
.
3.6.2
Configure VLAN segregation
Prerequisite for setting up VLANs in the device is that you have created a VLAN plan for your
network
(see on page 17 “VLAN plan”)
.
For details on how to configure VLANs, see the reference manual "Graphical User Interface" and
the user manual "Configuration".
Note:
If you use certain redundancy protocols, use only VLAN IDs ≥2 for payload traffic and device
management
(see on page 21 “VLAN plan considerations depending on redundancy protocols”)
.
3.6.3
Disable GVRP and MVRP
The GARP VLAN Registration Protocol (GVRP) and its successor, the Multiple VLAN Registration
Protocol (MVRP) can be used to dynamically set up VLANs in a device. This also creates a
potential attack surface.
It is generally considered more secure to disable GVRP and MVRP. In the delivery state, GVRP
and MVRP are both globally disabled on the device.
3.6.4
Configure Port Security
Port Security is a concept to restrict which frames the network device accepts on a specific port.
Port Security distinguishes frames by their MAC source address. This restriction typically translates
to which source device the network device accepts on the port. The device drops frames with a
disallowed MAC source address. This can be helpful in securing your network.
To configure Port Security, create a list of allowed MAC source addresses. If the device receives a
frame with a MAC source address that is not on the allow list, the device can take a configurable
action like sending an SNMP trap to the network management station and/or disable the port.
For details, refer to the reference manual "Graphical User Interface", chapter "Port Security".
3.6.5
Configure ACLs
Configure ACLs
Summary of Contents for HIRSCHMANN HiOS-2A
Page 6: ...Contents 6 UM Security BRS 2A Release 8 7 05 2022 ...
Page 8: ...Document History 8 UM Security BRS 2A Release 8 7 05 2022 ...
Page 10: ...Safety instructions 10 UM Security BRS 2A Release 8 7 05 2022 ...
Page 54: ...Network security support 3 11 Configure logging 54 UM Security BRS 2A Release 8 7 05 2022 ...
Page 62: ...Index 62 UM Security BRS 2A Release 8 7 05 2022 ...
Page 66: ......
