IronPort Systems 4108GL User Manual

Page 195

10-11

Using Authorized IP Managers for Increased Management Security

Using Authorized IP Managers

Usin

Au
th

riz

Ma
nag

Table 10-2. Analysis of IP Mask for Single-Station Entries

Configuring Multiple Stations Per Authorized Manager IP
Entry

The mask determines whether the IP address of a station on the network meets
the criteria you specify. That is, for a given Authorized Manager entry, the
switch applies the IP mask to the IP address you specify to determine a range
of authorized IP addresses for management access. As described above, that
range can be as small as one IP address (if

255 is set for all octets in the mask),

or can include multiple IP addresses (if one or more octets in the mask are set
to less than

255).

If a bit in an octet of the mask is “on” (set to 1), then the corresponding bit in
the IP address of a potentially authorized station must match the same bit in
the IP address you entered in the Authorized Manager IP list. Conversely, if a
bit in an octet of the mask is “off” (set to 0), then the corresponding bit in the
IP address of a potentially authorized station on the network does not have to
match its counterpart in the IP address you entered in the Authorized Manager
IP list. Thus, in the example shown above, a “255” in an IP Mask octet (all bits
in the octet are “on”) means only one value is allowed for that octet—the value
you specify in the corresponding octet of the Authorized Manager IP list. A “0”
(all bits in the octet are “off”) means that any value from 0 to 255 is allowed
in the corresponding octet in the IP address of an authorized station. You can
also specify a series of values that are a subset of the 0-255 range by using a
value that is greater than 0, but less than 255.

1st
Octet

2nd
Octet

3rd
Octet

4th
Octet

Manager-Level or Operator-Level Device Access

IP Mask

255

The “255” in each octet of the mask specifies that only the exact value in
that octet of the corresponding IP address is allowed. This mask allows
management access only to a station having an IP address of 10.33.248.5.

Authorized
Manager IP

227

125