1-1
1
Port Security Configuration
When configuring port security, go to these sections for information you are interested in:
z
Introduction to Port Security
z
Port Security Configuration Task List
z
Displaying and Maintaining Port Security
z
Port Security Configuration Examples
z
Troubleshooting Port Security
Introduction to Port Security
Port Security Overview
Port security is a MAC address-based security mechanism for network access controlling. It is an
extension to the existing 802.1X authentication and MAC authentication. It controls the access of
unauthorized devices to the network by checking the source MAC address of an inbound frame and the
access to unauthorized devices by checking the destination MAC address of an outbound frame.
Port security allows you to configure a port to operate in an intended security mode to control the MAC
address learning or authentication on the port. This enables the port to learn legal source MAC
addresses.
With port security enabled, packets whose source MAC addresses cannot be learned by the device in a
security mode are considered illegal; the events that users do not pass 802.1X authentication or MAC
authentication are considered illegal.
Upon detection of illegal frames or events, the device takes the pre-defined action automatically. While
enhancing the system security, this reduces your maintenance efforts greatly.
The security modes of the port security feature provide extended and combined use of 802.1X
authentication and MAC authentication and therefore apply to scenarios that require both 802.1X
authentication and MAC authentication. For scenarios that require only 802.1X authentication or MAC
authentication for access control, however, you are recommended to configure the 802.1X
authentication or MAC authentication for simplicity. For information about 802.1X and MAC
authentication, refer to
802.1X Configuration
and
MAC Authentication Configuration
in the
Security
Volume.
Port Security Features
NTK
The need to know (NTK) feature checks the destination MAC addresses in outbound frames and allows
frames to be sent to only devices passing authentication, thus preventing illegal devices from
intercepting network traffic.
