MNS-BB
Software User Guide
-25-
control aspect of secure network services involves allowing or disallowing traffic between a private
network and an external network (such as the Internet) based on information contained in packets,
such as the IP address, MAC address, or content. One such technology is Access Control Lists
(ACL). An ACL is a packet filtering mechanism that reads a packet and allows it to pass or discards it
according to criteria set up by the system administrator LE2425A and LEV2525A switches support
the source MAC filtration in Port Security module.
6.6.1 Basic
Operation
Default Port Security Operation:
The default port security setting for each port is off. That is, any
device can access a port without causing a security reaction.
Intruder Protection:
A port that detects an “intruder” blocks the intruding device or drops the
packets from transmitting to the network through that port.
General Operation for Port Security:
On a per-port basis, you can set up security measures to block
unauthorized devices and send notice of security violations. Once you have configured port security,
you can then monitor the network for security violations through the Event Log.
For any port, you can configure the following:
Authorized (MAC) Addresses:
Specify devices (MAC addresses) that are allowed to send inbound
traffic through the port. This feature:
• Closes the port to inbound traffic from any unauthorized devices that are connected to the port.
• Provides the option for sending information to the log of a detected attempted security violation to a
network management station and disables the port.
Note:
There is a limitation of 200 MAC addresses per port and 500 MAC addresses per Switch for
Port Security.
6.6.2
Blocking Unauthorized Traffic
Unless you configure the switch to disable a port or drop the packets when a security violation is
detected, the switch security only blocks unauthorized traffic without disabling the port. This feature
enables you to apply the security configuration to ports on which hubs, switches, or other devices are
connected and maintain security while also maintaining network access to authorized users.
6.6.3
Planning For Port Security
1. Plan your port security configuration and monitoring according to the following:
a. On which ports do you want to configure port security?
b. Which devices (MAC addresses) are authorized on each port?
c. For each port, what security actions do you want? (The switch automatically blocks intruder
detected on that port from transmitting to the network.) The switch can be configured to
(i) Send intrusion alarms to the event Log and
(ii) Optionally disable the port on which the intrusion was detected.
d. How do you want to learn of the security violation attempts the switch detects? You can use the
Event Log (through the CLI
show log
command) to see the intrusion.
2. Use the CLI commands to configure port security operating and address controls.
6.7
CLI: Port Security Command Options and Operation
Configuring Port Security
Syntax:
configure port-security
LE2425A#
configure port-security OR port-security <
enter
>
It will take you to the configuration mode to configure the port security.
LE2425A(port-security)##
Allow an Authorized Device to a Port.
