Port Security Quick Start Configuration Guide

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The information in this document is subject to change without notice.

Contents

Configuring port security in autoLearn mode· 1

Introduction· 1

Network configuration· 1

Restrictions and guidelines· 1

Procedure· 1

Verifying the configuration· 2

Configuration files· 3

Related documentation· 4

 

Configuring port security in autoLearn mode

Introduction

The following information uses an example to describe the basic procedure for configuring a port in autoLearn mode for port security.

Network configuration

As shown in Figure 1, configure the user-attached port (Ten-GigabitEthernet 1/0/1 in this example) on the device to meet the following requirements:

·     Allow up to 64 users to access the Internet through the port without authentication.

·     Prevent additional users to access the Internet through the port after the number of online Internet users on the port reaches the limit.

To meet these requirements:

·     Place the port in autoLearn mode. In this mode, the port learns and adds MAC addresses to the secure MAC address table until the specified limit is reached.

·     Set port security's limit on the number of secure MAC addresses to 64.

·     By default, secure MAC addresses do not age out. To prevent inactive or malicious users from using secure MAC table entries permanently, set a secure MAC aging timer.

·     Set the intrusion protection action to disableport-temporarily. If a frame with an unknown MAC address arrives at the port when the secure MAC address table is full, shut down the port for 30 seconds.

Figure 1 Network diagram

 

Restrictions and guidelines

Set port security's limit on the number of secure MAC addresses on a port before you place that port in autoLearn mode. You cannot change the secure MAC address limit on a port in autoLearn mode.

Procedure

# Enable port security.

<Device> system-view

[Device] port-security enable

# Set the secure MAC aging timer to 30 minutes.

[Device] port-security timer autolearn aging 30

# Set port security's limit on the number of secure MAC addresses to 64 on Ten-GigabitEthernet 1/0/1.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] port-security max-mac-count 64

# Place the port in autoLearn mode for port security.

[Device-Ten-GigabitEthernet1/0/1] port-security port-mode autolearn

# Set the intrusion protection action to disableport-temporarily and configure port security to shut down the port for 30 seconds after intrusion protection is triggered.

[Device-Ten-GigabitEthernet1/0/1] port-security intrusion-mode disableport-temporarily

[Device-Ten-GigabitEthernet1/0/1] quit

[Device] port-security timer disableport 30

Verifying the configuration

# Execute the display port-security interface command to verify that port security is correctly configured.

[Device] display port-security interface ten-gigabitethernet 1/0/1

Global port security parameters:

   Port security          : Enabled

   AutoLearn aging time   : 30 min

   Disableport timeout    : 30 s

   Blockmac timeout       : 180 s

   MAC move               : Denied

   Authorization fail     : Online

   NAS-ID profile         : Not configured

   Dot1x-failure trap     : Disabled

   Dot1x-logon trap       : Disabled

   Dot1x-logoff trap      : Disabled

   Intrusion trap         : Disabled

   Address-learned trap   : Disabled

   Mac-auth-failure trap  : Disabled

   Mac-auth-logon trap    : Disabled

   Mac-auth-logoff trap   : Disabled

   Open authentication    : Disabled

   OUI value list         :

 

 Ten-GigabitEthernet1/0/1 is link-up

   Port mode                      : autoLearn

   NeedToKnow mode                : Disabled

   Intrusion protection mode      : DisablePortTemporarily

   Security MAC address attribute

       Learning mode              : Sticky

       Aging type                 : Periodical

   Max secure MAC addresses       : 64

   Current secure MAC addresses   : 5

   Authorization                  : Permitted

   NAS-ID profile                 : Not configured

   Free VLANs                     : Not configured

   Open authentication            : Disabled

   MAC-move VLAN check bypass     : Disabled

The output shows that the port allows a maximum of 64 secure MAC addresses, its port security mode is autoLearn, its intrusion protection action is DisablePortTemporarily, and it will shut down for 30 seconds after the intrusion protection action is triggered.

To view the number of secure MAC addresses learned on the port, examine the Current secure MAC addresses field.

# To view information about each secure MAC address, execute the display this command on the interface view for the port.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] display this

#

interface Ten-GigabitEthernet1/0/1

 port link-mode bridge

 port-security intrusion-mode disableport-temporarily

 port-security max-mac-count 64

 port-security port-mode autolearn

 port-security mac-address security sticky 00e0-fc00-5920 vlan 1

 port-security mac-address security sticky 00e0-fc00-592a vlan 1

 port-security mac-address security sticky 00e0-fc00-592b vlan 1

 port-security mac-address security sticky 00e0-fc00-592c vlan 1

 port-security mac-address security sticky 00e0-fc00-592d vlan 1

#

# When the number of MAC addresses learned on the port reaches 64, execute the display port-security interface command to verify that the port security mode changes to secure mode. In secure mode, the port stops learning MAC addresses. (Details not shown.)

# After the port receives a frame with an unknown MAC address, execute the display interface command to verify that the port shuts down for intrusion protection and comes up 30 seconds later. (Details not shown.)

# Delete several secure MAC addresses. Verify that the port security mode changes to autoLearn and the port can learn MAC addresses again. (Details not shown.)

Configuration files

#

 port-security enable

 port-security timer disableport 30

 port-security timer autolearn aging 30

#

interface Ten-GigabitEthernet1/0/1

 port link-mode bridge

 port-security intrusion-mode disableport-temporarily

 port-security max-mac-count 64

 port-security port-mode autolearn

#

Related documentation

·     Port security configuration in the security configuration guide for the device.

·     Port security commands in the security command reference for the device.