Filtering

Filtering is the process of including or excluding specified packets for delivery to a specified network segment. You can use filters to decrease the level of traffic on your network and eliminate most of the unnecessary traffic between segments.

The following sections describe various types of filtering, including SAP and IP filtering

For more information, see the following topics:


Filtering Process

Dynamic and Static Filters

Types of Filters

Only and Except

Filter Lists

IP Filtering

SAP Filters

Filtering Process

The filtering process performs tests to determine whether a packet should be passed to another network segment. A series of different filters can be used. If a packet fails any of the filters, it is discarded and not forwarded by the bridge or router to the next network segment. At each stage the packet is either filtered or forwarded to the next filter. Packet is forwarded to other bridge ports (bridging)

Dynamic and Static Filters

Dynamic filters occur automatically when the bridge or router is switched on. The device learns the addresses of devices by looking at packets on the network, and uses this information to forward or filter packets. Static filters are created manually by the system administrator.

Types of Filters

The following are some common types of filtering :

Destination filtering

Filters packets according to their destination address. Destination filtering can be used as a security measure to filter packets going to certain devices.

Source filtering

Filters packets according to their source address. Source filtering can be used as a security measure to filter packets coming from certain devices.

Access Group filtering

Controls communication between stations on the network. Access group filters can prevent members of two groups of stations from communicating, permit a specific station to communicate with all other stations, and perform other combinations of permitting or preventing communication between groups.

Type filtering

Filters packets according to their protocol type (for example, UDP or TCP), or service type (for example SAP number).

Only and Except

Most filters can be set to pass only packets that match the characteristics set in the filter or to pass all packets except those specified in the filter

Filter Lists

You can configure a list of different filters, where each filter specifies a set of addresses to which certain packets may or may not be sent. You name each filter and configure filter lists for each phone group.

MAC Addresses

LanRover Access Switches perform MAC address translation. This means the MAC address of every remote node is mapped to one of the LanRover Access Switch's 256 bridged MAC addresses. The LanRover Access Switch substitutes the translated MAC address in the Address Resolution Protocol (ARP) portion of IP ARP and AppleTalk ARP packets. No other packet types have the protocol portion of the packet translated.

The LanRover Access Switch learns the MAC addresses of remote nodes dynamically by snooping packets it receives on dial-up connections. When it receives a packet from a remote node that it has no record of, it creates a map of that node's MAC address to one of the LanRover Access Switch's 256 MAC addresses. This means that each remote node is unreachable using a unicast MAC address from the LanRover Access Switch's LAN until that remote node generates a packet to the LanRover Access Switch's LAN.

Considerations
When using transparent bridging, remember to consider the following

The Shiva device allows bridging of one protocol and routing of another protocol on the same dial-up connection
BCP may be run on either single-user or LAN-to-LAN connections with identical functionality.
BCP bridging is not be supported on the Token-Ring version of the LanRover Access Switch.
Virtual connections with bridging are not supported.
BCP cannot run on the same connection as either NBCP or NBFCP
The Shiva device cannot initiate BCP connections.
The same protocol may be bridged on one dialup connection and routed on another.
When bridging IP, the Shiva device can run as an IP concentrator, but cannot run in IP router mode.


Bridging over AppleTalk*

AppleTalk nodes on the LAN of one Shivaź AccessPort that is dialed into a LanRover Access Switch cannot communicate with AppleTalk nodes on another AccessPort LAN dialed into the same LanRover Access Switch. When bridging AppleTalk, the Shiva device can run as an AppleTalk end-node concentrator, but cannot run in AppleTalk router mode.

AccessPort Interoperability

Bridging is not guaranteed to work if a device other than an AccessPort dials into the Shiva device. Specifically, devices performing 802.1d (Spanning Tree) do not work when dialing into the Shiva device with BCP. When an AccessPort dials into a Shiva device, the AccessPort can not be running in Spanning Tree mode. Multiple AccessPorts on the same LAN cannot dial in to the same Shiva device while bridging. AccessPort to Shiva device AppleTalk bridging works for MAC IP as long as the Shiva device is not a MAC IP gateway