6–4
MULTILINK ML810 MANAGED EDGE SWITCH – INSTRUCTION MANUAL
CONFIGURING PORT SECURITY THROUGH THE COMMAND LINE INTERFACE
CHAPTER 6: ACCESS CONSIDERATIONS
•
remove mac
- removes specific or all MAC addresses from port security lookup
•
signal port=<num|list|range>
- observe list of specified ports and notify if
there is a security breach on the list of port specified. The signal can be a log entry,
a trap to the trap receiver specified as part of the SNMP commands (where is that
specified) or both
NOTE
Note
There is a limitation of 200 MAC addresses per port and 500 MAC addresses per switch for
port security.
NOTE
Note
All commands listed above must be executed under the port security configuration mode.
Let's look at a few examples. The following command allows specific MAC addresses on a
specified port. No spaces are allowed between specified MAC addresses.
ML810(port-security)##
allow mac=00:c1:00:7f:ec:00,00:60:b0:88:9e:00
port=18
The following command sequence sets the port security to learn the MAC addresses. Note
that a maximum of 200 MAC addresses can be learned per port, to a maximum of 500 per
switch. Also, the
action
on the port must be set to none before the port learns the MAC
address information.
ML810(port-security)##
action port=1, 2 none
ML810(port-security)##
learn port=1, 2 enable
The following command sequence enables and disables port security
ML810(port-security)##
ps enable
Port Security is already enabled
ML810(port-security)##
ps disable
Port Security Disabled
ML810
ps enable
Port Security Enabled
6.2.2
Allowing MAC Addresses
The Port Security feature has to be used with the combination of commands shown below
in order for it to be implemented successfully.
To configure a port to allow only a certain MAC address (single or a list of max 200 MAC
addresses per port and 500 MAC addresses per ML810, as per manuals) we have to:
1.
Verify that the port is in default port security status.
2.
Use the following commands:
#port-security
(port-security)##ps enable
(port-security)##allow mac=<address,list,range> port=<num,list,range>
(port-security)##action port=<num,list,range>drop
NOTE
Note
All the above commands have to be configured in this sequence, otherwise the port will
remain insecure.
