7-10
Using Passwords, Port Security, and Authorized IP Managers To Protect Against Unauthorized Access
Configuring and Monitoring Port Security
Usi
ng P
a
sswo
rds,
P
o
rt
Se
c
u
rity,
a
n
d
A
u
th
o
riz
e
d
IP
b.
Which devices (MAC addresses) are authorized on each port (up to 8
per port)?
c.
For each port, what security actions do you want? (The switch
automatically blocks intruders detected on that port from transmit-
ting to the network.) You can configure the switch to (1) send intru-
sion alarms to an SNMP management station and to (2) optionally
disable the port on which the intrusion was detected.
d.
How do you want to learn of the security violation attempts the switch
detects? You can use one or more of these methods:
–
Through network management (That is, do you want an SNMP
trap sent to a net management station when a port detects a
security violation attempt?)
–
Through the switch’s Intrusion Log, available through the CLI,
menu, and web browser interface
–
Through the Event Log (in the menu interface or through the CLI
show log
command)
2.
Use the CLI or web browser interface to configure port security operating
and address controls. The following table describes the parameters.
Recommended Port Security Procedures
■
Before configuring port security, use the switch’s TFTP features to save a
copy of the configuration. In the event that you later want to remove the
switch’s port security configuration (including MAC addresses the switch
has authorized) and reconfigure port security, your task will be easier.
■
If you want to manually configure the authorized MAC addresses for a
port (instead of allowing the switch to learn whatever MAC addresses it
detects first on the port), then prior to configuring the Static learn mode
on a port, remove the LAN link from the port. This prevents the port from
automatically learning MAC addresses that you do not want to include in
the authorized list. After you use the
port-security <port-list> mac-address
<mac-addr>
command to configure the authorized addresses you want in
the list, reconnect the link.
■
After you configure the authorized MAC addresses you want on a port,
execute the
write memory
command to make these addresses permanent
in the switch’s configuration.
