Transition Networks
S4224 Web User Guide
33558 Rev. C
Page 92 of 669
Aging Period
If checked, then the aging period is controlled with this input. If other modules are using the
underlying port security for securing MAC addresses, they may have other requirements to the aging
period. The underlying port security will use the shorter requested aging period of all modules that
use the functionality.
The Aging Period can be set to a number between
10
and
10,000,000
seconds. The IEEE 802.1d
recommends
300
seconds per entry.
To understand why aging may be desired, consider the following scenario: Suppose an end-host is
connected to a 3rd party switch or hub, which in turn is connected to a port on this switch on which
Limit Control is enabled. The end-host will be allowed to forward if the limit is not exceeded. Now
suppose that the end-host logs off or powers down. If it wasn't for aging, the end-host would still take
up resources on this switch and will be allowed to forward. To overcome this situation, enable aging.
With aging enabled, a timer is started once the end-host gets secured. When the timer expires, the
switch starts looking for frames from the end-host, and if such frames are not seen within the next
Aging Period, the end-host is assumed to be disconnected, and the corresponding resources are
freed on the switch.
Port Configuration
At Port Security Limit Control Configuration, the Port Configuration table has one row for each S4224 port
a number of columns, which are explained below.
Port
The port number to which the configuration below applies. The * in the Port column acts as a ‘wild
card’ character which causes the selections in this row to be applied to all other rows in the table for
which this selection is valid.
Mode
Controls whether Limit Control is enabled on this port. Both this and the ‘Global Mode’ must be set to
Enabled for Limit Control to be in effect. Notice that other modules may still use the underlying port
security features without enabling Limit Control on a given port.
Limit
The maximum number of MAC addresses that can be secured on this port. Enter a number from
1
-
1024
. If this limit is exceeded, the corresponding action is taken. The S4224 is "born" with a total
number of MAC addresses from which all ports draw whenever a new MAC address is seen on a Port
Security-enabled port. Since all ports draw from the same pool, it may happen that a configured
maximum cannot be granted, if the remaining ports have already used all available MAC addresses.
Action
If the ‘Limit’ defined above is reached, the S4224 can take one of the following actions:
None
: Do not allow more than ‘Limit’ MAC addresses on the port, but take no further action.
Trap
: If ‘Limit’ + 1 MAC addresses is seen on the port, send an SNMP trap. If Aging is disabled, only
one SNMP trap will be sent, but with Aging enabled, new SNMP traps will be sent every time the limit
gets exceeded.
Shutdown
: If ‘Limit’ + 1 MAC addresses is seen on the port, shut down the port. This implies that all
secured MAC addresses will be removed from the port, and no new address will be learned. Even if
the link is physically disconnected and reconnected on the port (by disconnecting the cable), the port
will remain shut down.
