HP 10500 series, Security Configuration Manual

Page: 213 / 596

199
Step Command Remarks
5. (Optional.) Set the silence
timeout period during which
a port remains disabled.
port-security timer disableport
time-value
By default, the port silence
timeout is 20 seconds.
NOTE:
On a port operating in either macAddressElseUserLoginSecure mode or
macAddressElseUserLoginSecureExt mode, intrusion protection is triggered only after both MAC
authentication and 802.1X authentication fail for the same frame.
Configuring secure MAC addresses
Secure MAC addresses are configured or learned in autoLearn mode. If the secure MAC addresses
are saved, they can survive a device reboot. You can bind a secure MAC address only to one port in
a VLAN.
Secure MAC addresses include static, sticky, and dynamic secure MAC addresses.
Table 15 A comparison of static, sticky, and dynamic secure MAC addresses
Type Address sources Aging mechanism
Can be saved and
survive a device
reboot?
Static
Manually added (by using
the
port-security
mac-address security
command without the
sticky keyword).
Not available.
The static secure MAC addresses
never age out unless you perform any
of the following tasks:
•
Manually remove these MAC
addresses.
•
Change the port security mode.
•
Disable the port security feature.
Yes.
Sticky
•
Manually added (by
using the
port-security
mac-address
security command
with the sticky
keyword).
•
Converted from
dynamic secure MAC
addresses.
•
Automatically learned
when the dynamic
secure MAC feature is
disabled.
By default, sticky MAC addresses do
not age out. However, you can
configure an aging timer or use the
aging timer together with the inactivity
aging feature to remove old sticky MAC
addresses.
•
If only the aging timer is
configured, the aging timer counts
up regardless of whether traffic
data has been sent from the sticky
MAC addresses.
•
If both the aging timer and the
inactivity aging feature are
configured, the aging timer
restarts once traffic data is
detected from the sticky MAC
addresses.
Yes.
The secure MAC
aging timer restarts at
a reboot.
Dynamic
•
Converted from sticky
MAC addresses.
•
Automatically learned
after the dynamic
secure MAC feature is
enabled.
Same as sticky MAC addresses.
No.
All dynamic secure
MAC addresses are
lost at reboot.