Dell BigIron RX Series, Руководство по настройке

Страница: 1028 / 1458

952 BigIron RX Series Configuration Guide
53-1002253-01
Defining security violation actions
32
•
Deny the packet from the unauthorized MAC address, but allow packets from secure MAC
addresses.
These actions can be configured on the global or interface level. The violation action on the global
level is not used if violation action is configured on an interface level.
Shutdown the interface
By default, the device shuts down the interface on the first violation. When the interface is
shutdown, it is disabled for a period of time, as specified by the configured age timer.
To enable this action, enter the following command.
BigIron RX(config)# int e 7/11
BigIron RX(config-if-e100-7/11)#port security
BigIron RX(config-port-security-e100-7/11)# violation shutdown
Syntax: [no] violation shutdown
Restricting interface access
You can configure the device to drop packets from an unsecure MAC address, while allowing
packets from secure MAC address to access the interface. The interface remains enabled.
To enable this action, enter the following commands.
BigIron RX(config)# int e 7/11
BigIron RX(config-if-e100-7/11)# port security
BigIron RX(config-port-security-e100-7/11)# violation restrict
Syntax: [no] violation restrict [ <#-denied-packets-processed> | force]
The violation restrict command enables the violation restrict action.
Entering a value for #-denied-packets-processed specifies the number of packets from one
unsecure MAC address that can be processed in one second on the interface. Once this number is
reached, the interface is shutdown. Refer to
“Restricting the number of packets per MAC address”
on page 952 for details.
Entering the force parameter forces the interface to shutdown once the
#-denied-packets-processed has been reached. If this parameter is not configured, then the
system will ask to confirm whether or not the interface is to be shutdown.
If violation restrict is the configured action when a security violation occurs, one of the following
options can be configured:
•
Restrict the number of packets received per MAC address
•
Restrict the number of MAC addresses denied on an interface
•
Log denied MAC addresses
Restricting the number of packets per MAC address
You can indicate the number of packets in one second that can be processed for one particular
denied MAC address before the interface shuts down. If the number of packets received exceeds
this number, the interace shuts down.
To enable this option, enter a command such as the following.