OmniSwitch os6900, Network Configuration Manual, Page: 810 / 942

Configuring Learned Port Security Configuring Learned Port Security
page 31-10 OmniSwitch AOS Release 7 Network Configuration Guide June 2013
Configuring Learned Port Security
This section describes how to use Command Line Interface (CLI) command to configure Learned Port
Security (LPS) on a switch. See the
“Sample Learned Port Security Configuration” on page 31-3 for a
brief tutorial on configuring LPS.
Configuring LPS involes the following procedures:
•
Enabling LPS for one or more switch ports. This procedure is described in “Configuring the LPS Port
Administrative Status” on page 31-10 .
•
Configuring the source learning time window during which MAC addresses are learned. This
procedure is described in
“Configuring the LPS Learning Window” on page 31-12 .
•
Configuring the maximum number of bridged MAC addresses allowed on an LPS port. This procedure
is described in
“Configuring the Number of Bridged MAC Addresses Allowed” on page 31-14 .
•
Configuring the maximum number of filtered MAC addresses allowed on an LPS port. This procedure
is describe in
“Configuring the Number of Filtered MAC Addresses Allowed” on page 31-14
•
Configuring a range of authorized MAC addresses allowed on an LPS port. This procedure is described
in
“Configuring an Authorized MAC Address Range” on page 31-15 .
•
Specifying whether or not an LPS port shuts down all traffic or only restricts traffic when an
unauthorized MAC address is received on the port. This procedure is described in
“Selecting the Security Violation Mode” on page 31-16 .
Configuring the LPS Port Administrative Status
The port-security command is used to configure the administrative status of LPS on a port using one of
the following three parameter options:
enable Enables LPS functionality on the port. When LPS is enabled:
•
All MAC addresses are cleared.
•
The LPS configuration is applied to source learning on the port.
•
The port can go into a shutdown, restricted, or discard state (based on
the configured violation mode) when unauthorized addesses are
received on the port.
disable Disables LPS functionality on the port. When LPS is disabled:
•
All filtered and bridged MAC addresses are cleared.
•
Pseudo-static and static addresses remain in a forwarding state.
•
The static MAC configuration is retained.
•
The LPS configuration is retained but not applied.
•
Learning on the port is wide open; not restricted by LPS.
locked Disables all learning on the port. When LPS is locked:
•
Existing MAC addresses are retained.
•
No additional learning is allowed.
•
Static MAC addresses are still allowed.