HP J8697A, Access Security Manual

Page: 317 / 390

Configuring and Monitoring Port Security
Port Security
• Static: Enables you to set a fixed limit on the number of MAC
addresses authorized for the port and to specify some or all of the
authorized addresses. (If you specify only some of the authorized
addresses, the port learns the remaining authorized addresses from
the traffic it receives from connected devices.)
• Configured: Requires that you specify all MAC addresses authorized
for the port. The port is not allowed to learn addresses from inbound
traffic.
■ Authorized (MAC) Addresses: Specify up to eight devices (MAC
addresses) that are allowed to send inbound traffic through the port. This
feature:
• Closes the port to inbound traffic from any unauthorized devices
that are connected to the port.
• Provides the option for sending an SNMP trap notifying of an
attempted security violation to a network management station
and, optionally, disables the port. (For more on configuring the
switch for SNMP management, see “Trap Receivers and Authen­
tication Traps” in the
Management and Configuration Guide for
your switch.)
■ Port Access: Allows only the MAC address of a device authenticated
through the switch’s 802.1X Port-Based access control. Refer to chapter
10, Configuring Port-Based and Client-Based Access Control (802.1X).
For configuration details, refer to “Configuring Port Security” on page 11-12.
Eavesdrop Protection
Configuring port security on a given switch port automatically enables eaves-
drop protection for that port. This prevents use of the port to flood unicast
packets addressed to MAC addresses unknown to the switch. This blocks
unauthorized users from eavesdropping on traffic intended for addresses that
have aged-out of the switch’s address table. (Eavesdrop prevention does not
affect multicast and broadcast traffic, meaning that the switch floods these
two traffic types out a given port regardless of whether port security is enabled
on that port.)
Blocking Unauthorized Traffic
Unless you configure the switch to disable a port on which a security violation
is detected, the switch security measures block unauthorized traffic without
disabling the port. This implementation enables you to apply the security
11-5