Network Ip Wg Rng Entry

1.3.6.1.4.1.52.4.2.2.2.3.1.2.11.3.1

Each entry configures a range of host IP addresses to be associated with a given interface ( port ). If the range consists of a single host address the entry may optionally specify a physical address. The entry is indexed by the range and the port. Ranges may not overlap. However a range may be duplicated on different ports. The address range must lie within the subnet defined for a given workgroup and thus the entry acquires the security level of that workgroup. If security is violated, packets to and from a given host IP address will be filtered out passing through the router. The source and destination IP packet addresses are checked against ranges in the range table during packet forwarding and must match as follows: For a high (4) security workgroup, a host must match a single host range entry - it must reside on the port with the physical address as configured in that entry. For a medium (3) security workgroup, a host must match a range entry in that it resides on that port, but unless a physical address is also specified in that entry, the physical address is not constrained. For a low (2) security workgroup, a host is free to reside on any port with any physical address as long as its IP address does not lie within the range of any entry in the range table, but if it does fall in a range then it must completely match that entry, or another entry with the duplicate range. Match completely means match the port and, if a physical address is specified, match that as well.