KSZ9567R_V01 datasheet(43/233 Pages) MICROCHIP

43 / 233 page

 2022 Microchip Technology Inc. and its subsidiaries

DS00002329E-page 43

KSZ9567R

sible to specify the port or ports to which to forward unknown packets. It is also possible to specify no ports, meaning

that unknown packets will be discarded. This feature is implemented separately for unknown unicast, unknown multicast

and unknown VID packets.

4.4.16

802.1X ACCESS CONTROL

IEEE 802.1X is a Port-based authentication protocol. EAPOL is the protocol normally used by the authentication pro-

cess as uncontrolled Port. By receiving and extracting special EAPOL frames, the host processor can control whether

the ingress and egress ports should forward packets or not. If a user port wants service from another port (authentica-

tor), it must get approved by the authenticator. The device detects EAPOL frames by checking the destination address

of the frame. The destination addresses should be either a multicast address as defined in IEEE 802.1x (01-80-C2-00-

00-03) or an address used in the programmable reserved multicast address domain with offset -00-03. Once EAPOL

frames are detected, the frames are forwarded to the host port so it can send the frames to the authenticator server.

Eventually, the CPU determines whether the requester is qualified or not based on its source MAC address, and frames

are either accepted or dropped.

When the device is configured as an authenticator, the ports of the switch must then be configured for authorization. In

an authenticator-initiated port authorization, a client is powered up or plugs into the port, and the authenticator port

sends an Extensible Authentication Protocol (EAP) PDU to the supplicant requesting the identification of the supplicant.

At this point in the process, the port on the switch is connected from a physical standpoint; however, the 802.1X process

has not authorized the port and no frames are passed from the port on the supplicant into the switching fabric. If the

supplicant attached to the switch (KSZ9567R) did not understand the EAP PDU that it was receiving from the switch, it

would not be able to send an ID and the port would remain unauthorized. In this state, the port would be blocked from

passing any user traffic. If the supplicant is running the 802.1X EAP, it would respond to the request with its configured

ID. (This could be a user name/password combination or a certificate.)

After the device receives the ID from the supplicant, it passes the ID information to an authentication server (RADIUS

server) that can verify the identification information. The RADIUS server responds to the switch with either a success

or failure message. If the response is a success, the port will be authorized and user traffic will be allowed to pass

through the port like any switch port connected to an access device. If the response is a failure, the port will remain

unauthorized and, therefore, unused. If there is no response from the server, the port will also remain unauthorized and

will not pass any traffic.

Port control can be performed via the Access Control List (ACL) Filtering feature.

4.4.17

ACCESS CONTROL LIST (ACL) FILTERING

An Access Control List (ACL) can be created for each port to perform filtering on incoming layer 2 MAC, layer 3 IP or

layer 4 TCP/UDP packets. Multicast filtering is handled in the Static Address Table and the Reserved Multicast Address

Table, but the ACL provides additional capabilities for filtering routed network protocols. As shown in Figure 4-3, ACL

filtering may take precedence over other forwarding functions.

The ACL allows the switch to filter ingress traffic based on the following header fields:

• Source or destination MAC address and/or EtherType

• Source or destination IPv4 address with programmable mask

• IPv4 protocol

• Source or destination UDP port

• Source or destination TCP port

• TCP Flag with programmable mask

The ACL is implemented as an ordered list of up to 16 access control rules which are programmed into the ACL Table.

Each entry specifies certain rules (a set of matching conditions and action rules) to control the forwarding and priority

of packets. When a packet is received on an interface, the switch compares the fields in the packet against any applied

ACLs to verify that the packet has the permissions required to be forwarded, based on the conditions specified in the

lists. Multiple match conditions can be either AND'ed or OR'ed together.

The ACL can also implement a count function that generates an interrupt rather than a forwarding action. The counter

can be either a watchdog timer or an event counter. As a watchdog timer, an interrupt is generated if a packet with a

specific MAC address and EtherType is not received within a specified time interval. As an event counter, an interrupt

is generated once a specified number of packets with a specific MAC address and EtherType have been received.

KSZ9567R 数据表(PDF) 43 Page - Microchip Technology

KSZ9567R 数据表(HTML) 43 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

数据表下载