174
•
MAC learning control
—Includes two modes: autoLearn and secure. MAC address learning is
permitted on a port in autoLearn mode and disabled in secure mode.
•
Authentication
—Security modes in this category implement MAC authentication, 802.1X
authentication, or a combination of these two authentication methods.
Upon receiving a frame, the port in a security mode searches the MAC address table for the source MAC
address. If a match is found, the port forwards the frame. If no match is found, the port learns the MAC
address or performs authentication, depending on the security mode. If the frame is illegal, the port takes
the predefined NTK or intrusion protection action. Outgoing frames are not restricted by port security's
NTK action unless they trigger the NTK feature.
The maximum number of users a port supports equals the smaller value from the following values:
•
The maximum number of secure MAC addresses that port security allows.
•
The maximum number of concurrent users the authentication mode in use allows.
For example, if 802.1X allows more concurrent users than port security's limit on the number of MAC
addresses on the port in userLoginSecureExt mode, port security's limit takes effect.
describes the port security modes and the security features.
Table 14
Port security modes
Purpose Security
mode
Features that can be
triggered
Turning off the port security
feature
noRestrictions (the default mode)
In this mode, port security is disabled on the port
and access to the port is not restricted.
N/A
Controlling MAC address
learning
autoLearn
NTK/intrusion
protection
secure
Performing 802.1X
authentication
userLogin N/A
userLoginSecure
NTK/intrusion
protection
userLoginSecureExt
userLoginWithOUI
macAddressWithRadius
NTK/intrusion
protection
Performing a combination of
MAC authentication and
Or
macAddressOrUserLoginSecure
NTK/intrusion
protection
macAddressOrUserLoginSecureExt
Else
macAddressElseUserLoginSecure
macAddressElseUserLoginSecureExt
