ACL restriction of multicast and broadcast on SRW2016

Hello all,
I seem to be having difficulty setting up an ACL that restricts multicast and broadcast packets to a specified port on the SRW2016.
In brief, I have one (physical) port that I need to prevent any broadcast or multicast packets from being sent to. I need to allow clients which are on that port to send broadcast, however. My take on this was to create an ACL with one rule of the type:
Type: Deny
Protocol: Any
Source IP: 10.0.0.0/255.255.255.255
Destination IP: 224.0.0.0/0.255.255.255
Another type I tried was a 2-rule ACL to explicitly allow only a valid sender and deny all:
Type: Allow
Protocol: UDP
Dest Port: 1234
Source IP: 10.1.0.100/0.0.0.0
Dest IP: 10.1.0.101/0.0.0.0
Type: Deny
Protocol: All
I have tried various permutations these types of ACL (changing ordering, etc) but everything I have tried so far has allowed the multicast packets through unless I block it at the sending port (which obviously blocks it from all ports).
Any suggestions or comments would be appreciated. Is what I'm trying to do even possible in the SRW2016?
Thanks,
Mike

Just to make sure I was creating/applying the ACLs correctly, I did a simple test with a very basic rule: I just set type to deny (basically a deny all rule). I applied this rule to one port of the switch and verified that it was working by attempting to access the switch's web configuration interface (which correctly was inaccessable). However, the multicast packets were still being delivered (verified via both an Ethernet dump and visual inspection of the switch's LED).
Based on the above information, I feel it's fairly safe to say that Multicast is not filtered correctly via ACLs on the SRW2016. Apparently Multicast packets take a different logical path than "normal" packets. Since I don't expect an immediate firmware patch, I suspect that I need to see if I can get a router in addition or as a replacement for the switch.
Edit: I found a method that appears to restrict the multicast packets via the "Bridge Multicast" interface (basically created a rule for the MAC related to my multicast address, set to Forbidden on one port, but this is not a generic solution for all multicast and I don't seem to be able to have more than 1 MAC address in the list...), but broadcast still gets through, regardless of the ACL I set up for the port.
I'm beginning to wonder if my understanding of ACLs is flawed - does anyone know if they're applied to incoming packets for a port, outgoing packets for a port or both? My assumption was both, but if the rule were only applied to incoming packets, it would explain the behavior I'm observing.
Message Edited by michael.beresford on 03-02-2009 02:46 PM

Similar Messages

What is the diffrence between multicasting and broadcasting?

hi friends
What is the diffrence between multicasting and broadcasting?
i'm bit confused in multicasting and broadcasting.

Broadcasts go everywhere within a range determined by the sender.
Broadcasting is deprecated and unliikely to go beyond the nearest router.
Multicasts go everywhere where receivers have declared they are present.
Multicast can be implemented beyond routers in a WAN which you control but ISP routers generally don't support it.

MultiCast and broadcast comm.

Hi all,
here is my issue : I have a server sending messages (via UDP) on the network. I have multiple client reading these. To do this I have ti use java socket and I have 2 solutions :
- use Socket and send/read DatagramSocket : the problem is I can't have multiple client reading the same port number on the same computer : socket aloready bind exeption
- use MulticastSocket : Several clients can now read the same port number from the same computer but if I am disconnected from the network, I have a SocketException (error setting options).
I user j2sdk 1.4.2 under win XP...
Thanks for help !

hello,
i have got the same problem: java.net.SocketException: error setting options while my network is disconnect. What exaclty do you mean with "ex. reconntect"

Data socket and broadcast address

it's posible to use broadcast or multicast address to get resources in a local net?, in order not to specify the exact ip address where the resource is located.
many thanks in advance
Mikel Eguiraun

Hi,
you can broadcast using broadcast IP addresses (see link):
http://www.freesoft.org/CIE/RFC/922/10.htm
A broadcast is a data packet that is destined for multiple hosts. Broadcasts can occur at the data link layer and the network layer. Data-link broadcasts are sent to all hosts attached to a particular physical network. Network layer broadcasts are sent to all hosts attached to a particular logical network. The Transmission Control Protocol/Internet Protocol (TCP/IP) supports the following types of broadcast packets:
•All ones—By setting the broadcast address to all ones (255.255.255.255), all hosts on the network receive the broadcast.
•Network—By setting the broadcast address to a specific network number in the network portion of the IP address and setting all ones in the host portion of the broadcast address, all hosts on the specified network receive the broadcast. For example, when a broadcast packet is sent with the broadcast address of 131.108.255.255, all hosts on network number 131.108 receive the broadcast.
•Subnet—By setting the broadcast address to a specific network number and a specific subnet number, all hosts on the specified subnet receive the broadcast. For example, when a broadcast packet is set with the broadcast address of 131.108.4.255, all hosts on subnet 4 of network 131.108 receive the broadcast.
Also on the next link you can find multicast addresses explanation:
http://www.cisco.com/univercd/cc/td/doc/cisintwk/ito_doc/ipmulti.htm#wp1020564
You can find several examples of UDP Multicast and broadcast on the Examples of labview (go to Help
-> Find examples -> Search and then you write UDP).
Normally broadcasting and multicasting use that protocol (UDP) due to the fact it do not need an ACK in the communication. If you plan to use TCP then you will need a connection for each computer (IP). There are also examples with labview of TCP with multiple connections.
Hope that info helps u,
Regards,
Jaime Cabrera
NI Applications Engineering Spain

How to restrict S_ALR_87003642 - Open and Close Posting Periods entry/updat

How to restrict S_ALR_87003642 - Open and Close Posting Periods entry/update for certain group of users
eg. for Subsidiaries to openr/close periods of their own company only.
Refer to my screen, Company 1010 and 1060 is for Head Office while 1210 is for our Malaysia Company. How to restrict my Malaysia Company user to open and close only for 1210 and cannot perform any change to other Company.

Hi,
I guess you can use company code itself. Talk to your basis guy or else if you have some expertise & Authorization try out PFCG.
Regards
Santosh Hegde

How to restrict sales group and sales office in va01?

in transaction "va01" ,I want to restrict "sales group" and "sales office", but there is no
relative authorization object. I create a role named "z1000test001" with va01 , there are only "division","sales organization"
and "distribution channel" which could be restricted.
the authorization object with va01 is : V_VBAK_VKO.
and I find another authorization:V_VBKA_VKO ,which contains:"sales group" and "sales office",
but this one seems have no relationship with va01.
Is there any method to restrict "sales group" and "sales office" in va01?
Could anybody help me?

Hello,
This has been discussed before and there's a solution available.
Have a look at this thread: Authorization for Sales Office and Sales Group
Cheers
Jurjen

Is it possible to set up my iPad as a video camera and broadcast it real time to a TV via apple TV?

Is it possible to sey up my iPad as a video camera and broadcast it real time to a TV via Apple TV?

Use airplay to send what is on the iPad to your tv.
Since ipad2, you can display exactly what is on the ipad screento a tv via an adaper or via airplay through an apple TV.
http://support.apple.com/kb/ht5209
http://support.apple.com/kb/ht4437
General overview but lacks specifics.
http://accelerateyourmarketing.com/home-video-studio/
Video
https://www.youtube.com/watch?v=ce5FVJi0Uxw

I have to send messages through UDP multicast and unicast from same port. In Labview I tried that it throws error. I heard it is possible by means of Datagram (UDP unicast and multicast) Port Sharing. How can it be achieved in Labview?

I have to send UDP multicast and Unicast messages to a remote port from a single source/local port. I tried by opening UDP unicast and multicast in the same port and got the expected error. I tried by opening a unicast connection and sending unicast messages.After that when multicast messages has to send I closed unicast and opened multicast in the same port.This is not throwing any error. But my requirenment is to comminicate with another application in C ++ which recieves this data, throwing an error of lost connectivity and both the applications are not abled to communicate properly.
In the other application with C++ this is implemented using port sharing. So how port sharing can be implemented in labview so that I can send both multicast and unicast messages from the same port?
Thanks in advance

UDP is a sessionless protocol, meaning that anyone listening on the specified port CAN receive the data. CAN because as you noted there is no guarantee in the protocol that it will be received. And if you send the data not to a specific address but a multicast address not only one computer can receive it but in fact every computer on the same subnet listening to that multicast address and depending on the TTL of the packet also computers in neighbouring subnets, although that last one is not a very reliable operation since routers can be configured to drop multicast packages anyhow despite of a different TTL saying otherwise.
Accordingly there is no real way to make sure that a receiving UDP port is not already in use, since you don't build up a connection. UDP is more or less analogous to shouting your messages through a megaphone, and anyone listening on the right frequency (port) can hear it. You do bind the sender socket to a specific port number but that makes little difference.
Rolf Kalbermatter
CIT Engineering Netherlands
a division of Test & Measurement Solutions

Multicast and wirerless

I have a 4404 controller running 6.0.202 code and more more people have Mac running bonjour and wanting to use Airplay. I see how to turn on Multicasting and even provide a Multicast address for IGMP snooping but does anyone have a good feel as to the overall load Multicast adds to the wireless network?
Thanks,
Gary

It depends on the type of deployment you have.
If the network infrastructure supports multicast, you should enable Multicast - Multicast as the controller multicast mode and choose a multicast address in the 239.X.X.X range.
If your network is not capable of supporting multicast, you would want to select Multicast - Unicast mode. This mode puts a load on the controller and on the wireless network as the Multicast is then sent as a unicast to each access point instead.
These support articles should help you.
Bonjour Deployment Guide
http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_tech_note09186a0080bb1d7c.shtml
Multicast Deployment Guide
https://supportforums.cisco.com/docs/DOC-14713

Userexit to Restrict the VIEW and MODIFY of the Sales Order

Hello Everybody,
I need to do the following task.
I want to restrict to VIEW and MODIFY the sales order for particular sales office or sales group.
I need user exit for that.
Please help me by providing brief information.
Thanks
M Rahman

Hi Rahman
Instead of changing the DISPLAY and CHANGE status of Sales Order,
i think it would be better if u make a check at the time of SAVE.
When the SO is being saved in VA02,check the sales office or sales group
and then give a error message to the user, saying that he is not authorised to make changes to the
SO for this particular sales office or sales group.
For this you can use the inckude MV45AFZZ,and USER EXIT userexit_save_document.
Sample Code:
IF SALES_OFFICE EQ 'XYZ'.
MESSAGE 'Change not possible for this Sales Office' type 'E'.
ENDIF.
Regards
Hareesh Menon

Report execution for different variant and Broadcast

Hi experts,
i had a situation where i need to broadcast the same report for 100 vendors, but the information in the report will be different and specific to the vendor.
can i create different variant for each vendor and execute the report at the time in background and broadcast that to the vendors.
Is it possible for broadcasting the reports at a time
any idea will be appreciated
regards

Hi akshay
Is it like i can execute the report same time for different variants and broadcast that reports based on that variant to different vendor
for eg User A has to view report with Variant X.
User B has to view same report with variant Y
and so on is this possible for us to do at a time
or need to create different reprots for 100 vendors and broadcast them
Hope if u have any document for broadcasting that shows the steps to do this can you please share

[svn:fx-4.x] 15186: In RichEditableText handlePasteOperation() if there are no constraints (maxChars, restrict or displayAsPassword) and multiline text is allowed we can do an immediate return before the text is extracted from the text flow .

Revision: 15186
Revision: 15186
Author:   [email protected]
Date:     2010-03-31 16:42:19 -0700 (Wed, 31 Mar 2010)
Log Message:
In RichEditableText handlePasteOperation() if there are no constraints (maxChars, restrict or displayAsPassword) and multiline text is allowed we can do an immediate return before the text is extracted from the text flow. This should be the typically case when pasting large amounts of text.
QE notes:
Doc notes: None
Bugs: partial fix for SDK-25793
Reviewed By: Gordon
Tests run: checkintests
Is noteworthy for integration: No
Ticket Links:
    http://bugs.adobe.com/jira/browse/SDK-25793
Modified Paths:
    flex/sdk/branches/4.x/frameworks/projects/spark/src/spark/components/RichEditableText.as

Step by step, how did you arrive at seeing this agreement?

I cannot remember my restriction pass code, and I don't know how to retrieve it. Can someone help me, I'm new to this stuff!!

I set a restriction pass code, and when I tried to use it, it says it's wrong. But I had to put it in 2x so it can't be wrong. And I just set it this morning, so I didn't forget. It just won't let me in.

iOS: Forgotten passcode or device disabled after entering wrong passcode - http://support.apple.com/kb/ht1212 - Learn what to do if you have forgotten or can't remember your passcode, or if your device displays a message saying it is disabled.
If you cannot connect it to the computer to which the device was last connected (or the device was never connected to a computer) you will have to use recovery mode to completely reset the device, losing all data:
iOS: Unable to update or restore - http://support.apple.com/kb/HT1808 - recovery mode (e.g., cannot connect to computer last used to sync device, iTunes still asks for a password)

What is restriction code? And where i can find it?

What is restriction code? And where i can find it?

Settings > General > Restrictions is where you enable a restrictions passcode.
A restrictions passcode prevents access to certain apps or services or features of an iOS device. For example, you can prevent the deleting of any apps, prohibit in-app purchases, etetera. You can restrict the use of Facetime, the Camera, Safari, etc.

TS4268 I can't get the iMessage or FaceTime to work on my iPod touch. I updated to the latest iOS. I have ensured restrictions are off and 'Set Automatically' is selected under date & time settings. I can enter my apple ID, but it bounces back to the l

I can't get the iMessage or FaceTime to work on my iPod touch. I updated to the latest iOS. I have ensured restrictions are off and 'Set Automatically' is selected under date & time settings. I can enter my apple ID, but it bounces back to the first login screen.

I just hit the home key very fast 3 times and it worked. Glad to see that someone suggested this to another person with a mini. My gremlins are all gone. Yea to the forum .......Marci 73361

ACL restriction of multicast and broadcast on SRW2016

Similar Messages

Maybe you are looking for