HPE 704654-B21, Security Configuration Manual

Page: 205 / 540

192
Table 16 A comparison of static, sticky, and dynamic secure MAC addresses
Type Address sources Aging mechanism
Can be saved
and survive a
device reboot?
Static
Manually added (by using the
port-security mac-address
security command without
the sticky keyword).
Not available.
The static addresses never age out
unless you perform any of the following
tasks:
•
Manually remove these MAC
addresses.
•
Change the port security mode.
•
Disable the port security feature.
Yes.
Sticky
•
Manually added (by
using the
port-security
mac-address security
command with the sticky
keyword).
•
Converted from dynamic
secure MAC addresses.
•
Automatically learned
when the dynamic
secure MAC feature
(
port-security
mac-address dynamic )
is disabled.
By default, sticky MAC addresses do
not age out. However, you can
configure an aging timer or use the
aging timer together with the inactivity
aging feature to delete old sticky MAC
addresses.
•
If only the aging timer is
configured, the aging timer counts
up regardless of whether traffic
data has been sent from the sticky
MAC address.
•
If both the aging timer and the
inactivity aging feature are
configured, the aging timer restarts
once traffic data is detected from
the sticky MAC address.
Yes.
The secure MAC
aging timer restarts
at a reboot.
Dynamic
•
Converted from sticky
MAC addresses.
•
Automatically learned
after the dynamic secure
MAC feature is enabled.
Same as sticky MAC addresses.
No.
All dynamic secure
MAC addresses are
lost at reboot.
Configuration prerequisites
Before you configure secure MAC addresses, complete the following tasks:
•
Enable port security.
•
Set port security's limit on the number of MAC addresses on the port. Perform this task before
you enable autoLearn mode.
•
Set the port security mode to autoLearn.
•
Configure the port to permit packets of the specified VLAN to pass or add the port to the VLAN.
Make sure the VLAN already exists.
Configuration procedure
To configure a secure MAC address:
Step Command Remarks
1. Enter system view.
system-view N/A
2. (Optional.) Set the
secure MAC aging port-security timer autolearn aging
time-value By default, secure MAC
addresses do not age out.