HP A5830 Series, Configuration Manual

Page: 122 / 280

114
To do… Use the command… Remarks
1. Enter system view.
system-view —
2. Enter Layer 2 Ethernet
interface view.
interface interface-type interface-
number
—
3. Configure the intrusion
protection feature.
port-security intrusion-mode {
blockmac | disableport |
disableport-temporarily }
Required.
By default, intrusion protection is
disabled.
4. Return to system view.
quit —
5. Set the silence timeout period
during which a port remains
disabled.
port-security timer disableport
time-value
Optional.
20 seconds by default.
Enabling port security traps
You can configure the port security module to send traps for the following categories of events:
•
addresslearned —Learning of new MAC addresses.
•
dot1xlogfailure/dot1xlogon/dot1xlogoff
—802.1X authentication failure, success, and 802.1X user
logoff.
•
ralmlogfailure / ralmlogon/ralmlogoff —MAC authentication failure, MAC authentication user logon,
and MAC authentication user logoff.
•
intrusion —Detection of illegal frames.
To enable port security traps:
To do… Use the command… Remarks
1.
Enter system view.
system-view —
2.
Enable port security traps.
port-security trap {
addresslearned | dot1xlogfailure
| dot1xlogoff | dot1xlogon |
intrusion | ralmlogfailure |
ralmlogoff | ralmlogon }
Required.
By default, port security traps are
disabled.
Configuring secure MAC addresses
Secure MAC addresses are MAC addresses configured or learned in autoLearn mode. They can survive
link down/up events, and once saved, can survive a device reboot. You can bind a MAC address to
only one port in a VLAN.
Secure MAC addresses fall into static secure MAC addresses and sticky MAC addresses.
Static secure MAC addresses are manually configured at the command line or in the MIB in autoLearn
mode. No aging mechanism is available for this type of MAC address. They never age out unless you
manually remove them, change the port security mode, or disable the port security feature.
Sticky MAC addresses include dynamic secure MAC addresses manually configured at the command
line interface or in the MIB, and dynamic secure MAC addresses learned by a port in autoLearn mode.
These MAC addresses are sticky because unlike normal dynamic MAC addresses, they can survive link
down/up events, and once saved, can survive a device reboot.