HP E3800 Series, Access Security Manual

Page: 684 / 732

14-36
Configuring and Monitoring Port Security
Reading Intrusion Alerts and Resetting Alert Flags
■ The port comes up and will block traffic from unauthorized devices it
detects.
■ If the port detects another intruder, it will send another SNMP trap, but
will not become disabled again unless you first reset the port’s intrusion
flag.
This operation enables the port to continue passing traffic for authorized
devices while you take the time to locate and eliminate the intruder. Other-
wise, the presence of an intruder could cause the switch to repeatedly disable
the port.
CLI: Checking for Intrusions, Listing Intrusion Alerts,
and Resetting Alert Flags
The following commands display port status, including whether there are
intrusion alerts for any port(s), list the last 20 intrusions, and either reset the
alert flag on all ports or for a specific port for which an intrusion was detected.
(The record of the intrusion remains in the log. For more information, refer
to “Operating Notes for Port Security” on page 14-39.)
In the following example, executing
show interfaces brief
lists the switch’s port
status, which indicates an intrusion alert on port A1.
Syntax: show interfaces brief
List intrusion alert status (and other port status informa-
tion)’.
show port-security intrusion-log
List intrusion log content.
clear intrusion-flags
Clear intrusion flags on all ports.
port-security [e] < port-number > clear-intrusion-flag
Clear the intrusion flag on one or more specific ports.