Industrial Managed
Ethernet Switch – EH9711
User Manual
Page
59
of
223
Static entries are part of the running-config and will survive interface link state changes and reboots if saved to startup-
config. Static entries can be added to the running-config at any time whether or not Port Security is enabled.
Sticky
: When the interface is in sticky mode, all entries that would otherwise have been learned as dynamic are learned
as sticky. Like static entries, sticky entries are part of the running-config and will survive interface link state changes
and reboots if saved to the startup-config. Though not the intention with Sticky entries, they can be added by
management to the running-config at any time whether or not Port Security is enabled on the interface, as long as the
interface is in Sticky mode. Sticky entries will disappear if the interface is taken out of Sticky mode.
To add a new entry to the table of
Port Security Static and Sticky MAC Addresses
, click on
Add New MAC Entry
button.
The new entry as shown in Figure 2.53 allows for adding static or sticky MAC address to a particular interface. When adding
is finished, click the
Save
button to save the changes to running-config. Notice that sticky entries are normally added
automatically through learning on the interface. Table 2.34 provides descriptions of the fields for Port Security Static and
Sticky MAC Addresses.
Figure 2.53 Webpage
to Configure Network Port Security MAC Addresses
Table 2.34 Descriptions of RMON Event
Label
Description
Factory Default
Delete
Press this button to remove the entry from the MAC address table (if present)
and the running-config.
Notice that dynamic entries may be removed all-together on an interface
through "Monitor→Security→Port Security→Switch" and one-by-one through
"Monitor→Security→Port Security→Port"
Port
The port number to which this MAC address is bound.
Select …
VLAN ID
The VLAN ID in question.
1
MAC Address
The MAC address in question.
00:00:00:00:00:00
Type
Indicates the type of entry and may be either Static or Sticky (see description
above).
Static
2.5.2.3
NAS
NAS
is an acronym for Network Access Server. The NAS is meant to act as a gateway to guard access to a protected source.
A client connects to the NAS, and the NAS connects to another resource asking whether the client's supplied credentials are
valid. Based on the answer, the NAS then allows or disallows access to the protected resource. An example of a NAS
implementation is IEEE 802.1X.
The IEEE 802.1X standard defines a port-based access control procedure that prevents unauthorized access to a network by
requiring users to first submit credentials for authentication. One or more central servers, the backend servers, determine
whether the user is allowed access to the network. These backend (RADIUS) servers are configured on the
"
Configuration→Security→AAA
" webpage. The IEEE802.1X standard defines port-based operation, but non-standard
variants overcome security limitations.
MAC-based authentication allows for authentication of more than one user on the same port, and doesn't require the user to
have special 802.1X supplicant software installed on his/her system. The switch uses the user's MAC address to authenticate
against the backend server. Intruders can create counterfeit MAC addresses, which makes MAC-based authentication less
secure than 802.1X authentication.
