KSZ9563RNXI datasheet(41/226 Pages) MICROCHIP

41 / 226 page

 2017-2018 Microchip Technology Inc.

DS00002419D-page 41

KSZ9563R

would not be able to send an ID and the port would remain unauthorized. In this state, the port would be blocked from

passing any user traffic. If the supplicant is running the 802.1X EAP, it would respond to the request with its configured

ID. (This could be a user name/password combination or a certificate.)

After the device receives the ID from the supplicant, it passes the ID information to an authentication server (RADIUS

server) that can verify the identification information. The RADIUS server responds to the switch with either a success

or failure message. If the response is a success, the port will be authorized and user traffic will be allowed to pass

through the port like any switch port connected to an access device. If the response is a failure, the port will remain

unauthorized and, therefore, unused. If there is no response from the server, the port will also remain unauthorized and

will not pass any traffic.

Port control can be performed via the Access Control List (ACL) Filtering feature.

4.4.17

ACCESS CONTROL LIST (ACL) FILTERING

An Access Control List (ACL) can be created for each port to perform filtering on incoming layer 2 MAC, layer 3 IP or

layer 4 TCP/UDP packets. Multicast filtering is handled in the Static Address Table and the Reserved Multicast Address

Table, but the ACL provides additional capabilities for filtering routed network protocols. As shown in Figure 4-3, ACL

filtering may take precedence over other forwarding functions.

The ACL allows the switch to filter ingress traffic based on the following header fields:

• Source or destination MAC address and/or EtherType

• Source or destination IPv4 address with programmable mask

• IPv4 protocol

• Source or destination UDP port

• Source or destination TCP port

• TCP Flag with programmable mask

The ACL is implemented as an ordered list of up to 16 access control rules which are programmed into the ACL Table.

Each entry specifies certain rules (a set of matching conditions and action rules) to control the forwarding and priority

of packets. When a packet is received on an interface, the switch compares the fields in the packet against any applied

ACLs to verify that the packet has the permissions required to be forwarded, based on the conditions specified in the

lists. Multiple match conditions can be either AND'ed or OR'ed together.

The ACL can also implement a count function that generates an interrupt rather than a forwarding action. The counter

can be either a watchdog timer or an event counter. As a watchdog timer, an interrupt is generated if a packet with a

specific MAC address and EtherType is not received within a specified time interval. As an event counter, an interrupt

is generated once a specified number of packets with a specific MAC address and EtherType have been received.

The ACL consists of three parts: matching rules, action rules, and processing entries. A matching rule specifies what

comparison test shall be performed on the incoming packet. It can also enable a counter function. An action rule spec-

ifies the forwarding action to be taken if the matching test succeeds. Alternatively, when a count function is enabled in

a matching rule, the 11-bit count value is stored in the corresponding action rule field and there is no forwarding action.

In general, the 16 matching rules are not directly linked to the 16 action rules. For example, matching entry #0 is not

necessarily related to action entry #0. The exception is when the counter function is enabled in a matching rule, whereby

the matching rule and action rule fields at the same ACL table entry will function together and are no longer independent.

Each of the 16 processing entries is used to link any number of matching rules (specified in RuleSet) to any one action

rule (specified in FRN). When there are multiple matching rules in a RuleSet, those rules are AND'ed together. Only if

all of those matching results are true will the FRN action be taken.

It is also possible to configure the ACL table so that multiple processing entries specify the same action rule. In this way,

the final matching result is the OR of the matching results from each of the multiple RuleSets.

The 16 ACL rules represent an ordered list, with entry #0 having the highest priority and entry #15 having the lowest

priority. All matching rules are evaluated. If there are multiple true match results and multiple corresponding actions, the

highest priority (lowest numbered) of those actions will be the one taken.

KSZ9563RNXI 数据表(PDF) 41 Page - Microchip Technology

KSZ9563RNXI 数据表(HTML) 41 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

数据表下载