An internal network protection method and system

Abstract

The present application discloses an internal network protection method and system. The protection method includes: after a firewall receives a first data packet sent by a first switch, filtering the first data packet, and filtering the filtered first data packet sending the data packet to the aggregation switch; after receiving the second data packet sent by the aggregation switch, the firewall filters the second data packet, and sends the filtered second data packet to the second switch; Wherein, the first switch, the second switch and the aggregation switch are in the same virtual local area network. Through the above method, the attack behavior between internal network devices can be intercepted, and the mutual communication between clients in the same VLAN on different switches can be effectively prevented.

Description

technical field [0001] The present application relates to the technical field of network communication, and in particular, to an internal network protection method and system. Background technique [0002] Network security means that the hardware, software and data in the network system are protected from being damaged, altered or leaked due to accidental or malicious reasons, the system operates continuously, reliably and normally, and network services are not interrupted. With the development of Internet technology, an independent local area network is usually established in large enterprises for internal network communication. The local area network basically adopts the Ethernet based on broadcast technology. The communication packets between any two nodes are not only for The data received by the network cards of the two nodes is also intercepted by the network card of any node on the same Ethernet. Therefore, it is very necessary to protect the security of the internal...

AI Technical Summary

Problems solved by technology

In addition, by configuring port protection on the switch, a specific address can only communicate with clients on the same switch in the same virtual LAN

[0004] However, the inventors of the present application have discovered in the long-term research and development process that when the devices in the internal network attack each other, the firewall deployed between the internal network and the external network cannot effectively identify the network attack behavior between the internal devices, and cannot Cannot effectively prevent clients in the same VLAN on different switches from communicating with each other

Images