Access Security Guide K/KA/KB.15.15

Building IP Masks: Configuring one station per Authorized Manager IP entry
The IP Mask parameter controls how the switch uses an Authorized Manager IP value to recognize
the IP addresses of authorized manager stations on your network.
This is the easiest way to apply a mask. If you have ten or fewer management and/or operator
stations, you can configure them by adding the address of each to the Authorized Manager IP list
with 255.255.255.255 for the corresponding mask. For example, as shown in Figure 307
(page 416), if you configure an IP address of 10.28.227.125 with an IP mask of
255.255.255.255, only a station having an IP address of 10.28.227.125 has management
access to the switch.
Table 43 Analysis of IP Mask for Single-Station Entries
Manager-Level or Operator-Level Device Access4th Octet3rd Octet2nd Octet1st Octet
The “255” in each octet of the mask specifies that only
the exact value in that octet of the corresponding IP
255255255255IP Mask
1252272810Authorized
Manager IP
address is allowed. This mask allows management
access only to a station having an IP address of
10.33.248.5.
Building IP Masks: Configuring multiple stations per Authorized Manager IP entry
The mask determines whether the IP address of a station on the network meets the criteria you
specify. That is, for a given Authorized Manager entry, the switch applies the IP mask to the IP
address you specify to determine a range of authorized IP addresses for management access. As
described above, that range can be as small as one IP address (if 255 is set for all octets in the
mask), or can include multiple IP addresses (if one or more octets in the mask are set to less than
255).
If a bit in an octet of the mask is "on" (set to 1), then the corresponding bit in the IP address of a
potentially authorized station must match the same bit in the IP address you entered in the Authorized
Manager IP list. Conversely, if a bit in an octet of the mask is "off" (set to 0), then the corresponding
bit in the IP address of a potentially authorized station on the network does not have to match its
counterpart in the IP address you entered in the Authorized Manager IP list. Thus, in the example
shown above, a "255" in an IP Mask octet (all bits in the octet are "on") means only one value is
allowed for that octet—the value you specify in the corresponding octet of the Authorized Manager
IP list. A "0" (all bits in the octet are "off") means that any value from 0 to 255 is allowed in the
corresponding octet in the IP address of an authorized station. You can also specify a series of
values that are a subset of the 0-255 range by using a value that is greater than 0, but less than
255.
Table 44 Analysis of IP Mask for Single-Station Entries
Manager-Level or Operator-Level Device Access4th Octet3rd Octet2nd Octet1st Octet
The “255” in the first three octets of the mask specify
that only the exact value in the octet of the corresponding
0255255255IP Mask
1252272810Authorized
Manager IP
IP address is allowed. However, the zero (0) in the 4th
octet of the mask allows any value between 0 and 255
in that octet of the corresponding IP address. This mask
allows switch access to any device having an IP address
of 10.28.227.xxx, where xxx is any value from 0 to
255.
In this example (figure 15-8, below), the IP mask allows
a group of up to 4 management stations to access the
249255255255IP Mask
1252272810Authorized
Manager IP
switch. This is useful if the only devices in the IP address
group allowed by the mask are management stations.
The “249” in the 4th octet means that bits 0 and 3 - 7
of the 4th octet are fixed. Conversely, bits 1 and 2 of
the 4th octet are variable. Any value that matches the
Using 417