H3C SOHO IE4300, Command Reference Manual

Page: 2126 / 3296

13
Syntax
port-security intrusion-mode { blockmac | disableport |
disableport-temporarily }
undo port-security intrusion-mode
Default
Intrusion protection is disabled.
Views
Layer 2 Ethernet interface view
Predefined user roles
network-admin
Parameters
blockmac
: Adds the source MAC addresses of illegal frames to the blocked MAC address list and
discards frames with blocked source MAC addresses for a period set by the block timer. A blocked
MAC address will be unblocked when the block timer expires. The timer is fixed at 3 minutes. To
display the blocked MAC address list, use the
display port-security mac-address block
command.
disableport
: Disables the port permanently when an illegal frame is received on the port.
disableport-temporarily
: Disables the port for a period of time whenever it receives an
illegal frame. You can use the
port-security timer disableport
command to set the
period.
Usage guidelines
To bring up the port disabled by the intrusion protection feature, use the
undo shutdown
command.
Examples
# Configure GigabitEthernet 1/0/1 to block the source MAC addresses of illegal frames after
intrusion protection detects the illegal frames.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] port-security intrusion-mode blockmac
Related commands
display port-security
display port-security mac-address block
port-security timer disableport
port-security mac-address aging-type inactivity
Use
port-security mac-address aging-type inactivity
to enable inactivity aging for
secure MAC addresses.
Use
undo port-security mac-address aging-type inactivity
to disable inactivity
aging for secure MAC addresses.
Syntax
port-security mac-address aging-type inactivity
undo port-security mac-address aging-type inactivity