Method for access to control address through media and learning control equipment access to Ethernet

Abstract

The present invention discloses a method for controlling the access of a device into the Ethernet, which comprises the following steps that (a) access grant equipments or MAC addresses of the valid user are obtained, the corresponding ports of the MAC addresses are deployed to restricted ports on an exchanger, and an association relationship between the restricted ports and the valid user MAC addresses is built and kept; (b) when the device is accessed into the exchanger, the exchanger learns the MAC addresses of the device and the PORT of the exchanger entered by the data frame through the data frame sent by the equipment; (c) when the PORT is a restricted port and that the MAC addresses are the corresponding valid user MAC addresses is learned, the access of the user is prevented. The present invention can prevent the unauthorized access of invalid devices, unauthorized network changing and network attack of the invalid user, without adding a new device.

Description

technical field [0001] The invention relates to Ethernet communication technology, more specifically, a method for controlling user access in an Ethernet switch. Background technique [0002] With the rapid development of the Internet, the Ethernet network has gradually become an indispensable tool in people's daily work and life. At the same time, as the use of the Ethernet network increases, the network becomes larger and more difficult to manage. After the management personnel have built and debugged the network for users, preventing users from accessing and changing lines without authorization has become a concern. Access switches are generally relatively simple, without complicated control strategies, and with simple functions, just by learning the MAC (media access control) address of the data frame (the MAC address is the address used on the media access layer, also called the physical address), and realize the forwarding of Layer 2 data frames by learning the formed...

AI Technical Summary

Problems solved by technology

[0004] Among the methods of controlling illegal access in the prior art, one requires equipment other than switches to support, such as broadband authentication servers, etc., the cost is quite high, and the configuration is relatively complicated, which is not realistic for enterprises or small networks. The method is that switches support authentication protocols such as 802.1X, while simple and small Layer 2 switches generally do not support these protocols

At the same time, if the authentication protocol is enabled, a dedicated authentication server is also configured, and the client needs to install the specified software. This method has relatively high material and labor costs.

The user's needs may be to prevent illegal users from joining certain ports when they already have a very small network, and the number of legal users in the network is relatively fixed, or they do not want someone to build a stable network. Modify the network privately after forming, causing other problems

At the same time, in the case of meeting this requirement, it is not expected to add new equipment and management complexity

Images