HP 5120 EI Series, Configuration Manual

Page: 158 / 304

148

ralmlogfailure / ralmlogon/ralmlogoff —MAC authentication failure/MAC authentication user
logon/MAC authentication user logoff.

intrusion —Detection of illegal frames.
Follow these steps to enable port security traps:
To do… Use the command… Remarks
Enter system view system-view —
Enable port security traps
port-security trap {
addresslearned | dot1xlogfailure
| dot1xlogoff | dot1xlogon |
intrusion | ralmlogfailure |
ralmlogoff | ralmlogon }
Required
By default, port security traps are
disabled.
Configuring secure MAC addresses
Secure MAC addresses are MAC addresses configured or learned in autoLearn mode. They can survive
link down/up events, and once saved, can survive a device reboot. You can bind a MAC address to only
one port in a VLAN.
Secure MAC addresses fall into static secure MAC addresses and sticky MAC addresses.
Static secure MAC addresses are manually configured at the command line or in the MIB in autoLearn
mode. No aging mechanism is available for this type of MAC address. They never age out unless you
manually remove them, change the port security mode, or disable the port security feature.
Sticky MAC addresses include dynamic secure MAC addresses manually configured, at the command
line interface or in the MIB, and dynamic secure MAC addresses learned by a port in autoLearn mode.
These MAC addresses are sticky because unlike normal dynamic MAC addresses, they can survive link
down/up events, and once saved, can survive a device reboot.
By default, sticky MAC addresses do not age out. You can use the
port-security timer autolearn aging
command to set an aging timer for sticky MAC addresses. When the timer expires, the sticky MAC
addresses are removed. This aging mechanism prevents the unauthorized use of a sticky MAC address
when the authorized user is offline, and removes outdated secure MAC addresses so new secure MAC
addresses can be learned.
When the maximum number of secure MAC address entries is reached, the port changes to secure mode,
and no more secure MAC addresses can be added or learned. The port allows only frames sourced from
a secure MAC address or a MAC address configured with the
mac-address dynamic or mac-address
static command to pass through.
Configuration prerequisites
 Enable port security.
 Set port security’s limit on the number of MAC addresses on the port. Perform this task before you
enable autoLearn mode.

Set the port security mode to autoLearn.
Configuration procedure
Follow these steps to configure a secure MAC address: