Motorola EX-3524, Cli Reference Manual

Page: 221 / 617

Chapter 8
| General Security Measures
Port Security
– 221 –
Command Mode
Interface Configuration (Ethernet)
Command Usage
◆
The default maximum number of MAC addresses allowed on a secure port is
zero (that is, port security is disabled). To use port security, you must configure
the maximum number of addresses allowed on a port using the
port security
max-mac-count command.
◆
When port security is enabled using the port security command, or the
maximum number or allowed addresses is set to value lower than the limit after
port security has been enabled, the switch first clears all dynamically learned
entries from the address table. It then starts learning new MAC addresses on
the specified port, and stops learning addresses when it reaches a configured
maximum number. Only incoming traffic with source addresses already stored
in the dynamic or static address table will be accepted.
◆
To configure the maximum number of address entries which can be learned on
a port, first disable port security on a port using the
no port security
command, and then specify the maximum number of dynamic addresses
allowed. The switch will learn up to the maximum number of allowed address
pairs <source MAC address, VLAN> for frames received on the port. (The
specified maximum address count is effective when port security is enabled or
disabled.) Note that you can manually add additional secure addresses to a port
using the
mac-address-table static command. When the port has reached the
maximum number of MAC addresses, the port will stop learning new
addresses. The MAC addresses already in the address table will be retained and
will not be aged out.
◆
If port security is enabled, and the maximum number of allowed addresses are
set to a non-zero value, any device not in the address table that attempts to use
the port will be prevented from accessing the switch.
◆
If a port is disabled due to a security violation, it must be manually re-enabled
using the
no shutdown command.
◆
A secure port has the following restrictions:
■
Cannot be connected to a network interconnection device.
■
Cannot be a trunk port.
■
RSPAN and port security are mutually exclusive functions. If port security is
enabled on a port, that port cannot be set as an RSPAN uplink port, source
port, or destination port. Also, when a port is configured as an RSPAN
uplink port, source port, or destination port, port security cannot be
enabled on that port.